AZ-104 Monitor and Maintain Azure Resources Practice Question
Exhibit
Storage account: mystorage01 Diagnostic settings: - Send to Log Analytics workspace: Not configured - Archive to storage account: Off - Stream to event hub: Off Logs: Disabled Metrics: Enabled
Based on the exhibit, what should the administrator configure so storage logs can be queried later with KQL?
⚠ Common exam trap
It's easy for candidates to confuse data protection features (backup, locks, versioning) with logging and monitoring capabilities, failing to recognize that only diagnostic settings can route logs to a Log Analytics workspace for KQL queries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure diagnostic settings to send logs to a Log Analytics workspace.
Diagnostic settings in Azure allow you to stream platform logs, including storage logs, to a Log Analytics workspace. Once the logs are in Log Analytics, you can query them using Kusto Query Language (KQL) to analyze storage operations, errors, and metrics. This is the only option that directly enables querying storage logs with KQL.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a backup policy for the storage account so the logs are retained automatically.
Why it's wrong here
Azure Backup policies are designed to create recovery point copies for supported workloads, such as Azure VMs, SQL databases, or Azure Files—not to capture or retain operational logs from a storage account. A backup policy might protect the data held within the account, but it does not collect platform-level activity or diagnostic logs and send them to Log Analytics for querying. Backup retention is about restoring data artifacts, not about making resource operations searchable. Therefore, configuring a backup policy would not satisfy the requirement to make the storage account's logs accessible for investigation.
When this WOULD be correct
A question asks: 'You need to ensure that storage account data can be restored to a point in time after accidental deletion. What should you configure?' In that scenario, a backup policy (e.g., Azure Backup) would be the correct answer to enable data recovery.
- ✗
Enable a resource lock on the storage account so no logs are lost.
Why it's wrong here
A resource lock protects the storage account from accidental deletion or modification at the management plane, but it has no effect on log generation or log delivery. Locks do not collect operational events, nor do they route any data to Log Analytics; they simply enforce an Azure RBAC-like restriction that prevents write or delete operations. Even if a lock is in place, the storage account's activity and diagnostic logs remain subject to the same monitoring configuration—or lack thereof. Thus, a lock is a governance tool, not a logging or observability mechanism.
When this WOULD be correct
An administrator needs to ensure that diagnostic settings on a storage account cannot be deleted or altered by unauthorized users, and the question asks for a method to protect the configuration of log collection. In that case, enabling a resource lock would be correct.
- ✗
Turn on blob versioning so every change to the storage account is searchable.
Why it's wrong here
Blob versioning preserves a previous version of an object every time it is modified or deleted, which supports data recovery and point-in-time restore scenarios. However, versioning does not emit or forward any platform-level audit logs to Log Analytics; it only manages object snapshots within the storage account itself. While versioning might help you trace a change by comparing versions, it does not provide the KQL-queryable log stream that the administrator needs. Enabling versioning affects data plane object history, not the control-plane or data-plane activity logs that diagnostic settings would capture.
When this WOULD be correct
If the question asked 'How to preserve previous versions of blobs for point-in-time recovery or auditing changes to blob data?', then enabling blob versioning would be the correct answer.
- ✓
Configure diagnostic settings to send logs to a Log Analytics workspace.
Why this is correct
Diagnostic settings on a storage account export platform logs (such as StorageRead, StorageWrite, and StorageDelete) and metrics to a selected destination, including a Log Analytics workspace, where they become available for KQL queries. This is the only option that actually streamlines operational data into an analytical store, enabling you to filter, aggregate, and investigate activity directly. Because Azure Monitor diagnostic settings can be configured per resource and per log category, they provide the precise mechanism to make storage account events searchable and actionable.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Configure diagnostic settings to send logs to a Log Analytics workspace.Correct answer▾
Why this is correct
Diagnostic settings on a storage account export platform logs (such as StorageRead, StorageWrite, and StorageDelete) and metrics to a selected destination, including a Log Analytics workspace, where they become available for KQL queries. This is the only option that actually streamlines operational data into an analytical store, enabling you to filter, aggregate, and investigate activity directly. Because Azure Monitor diagnostic settings can be configured per resource and per log category, they provide the precise mechanism to make storage account events searchable and actionable.
✗Create a backup policy for the storage account so the logs are retained automatically.Wrong answer — click to see why▾
Why this is wrong here
Creating a backup policy for the storage account retains copies of data but does not capture or forward operational logs to a queryable destination like Log Analytics. KQL queries require logs in a Log Analytics workspace, not backup vaults.
★ When this WOULD be the correct answer
A question asks: 'You need to ensure that storage account data can be restored to a point in time after accidental deletion. What should you configure?' In that scenario, a backup policy (e.g., Azure Backup) would be the correct answer to enable data recovery.
Why candidates choose this
Candidates may confuse 'retaining logs' with 'retaining data backups,' assuming that backing up the storage account also preserves logs for querying. They overlook that logs must be explicitly sent to a Log Analytics workspace for KQL access.
✗Enable a resource lock on the storage account so no logs are lost.Wrong answer — click to see why▾
Why this is wrong here
A resource lock prevents accidental deletion or modification of the storage account, but it does not enable log collection or querying with KQL. Logs must be sent to a Log Analytics workspace to be queried with KQL.
★ When this WOULD be the correct answer
An administrator needs to ensure that diagnostic settings on a storage account cannot be deleted or altered by unauthorized users, and the question asks for a method to protect the configuration of log collection. In that case, enabling a resource lock would be correct.
Why candidates choose this
Candidates may think that locking the storage account preserves logs by preventing changes, but they overlook that logs must first be collected and sent to a queryable destination like Log Analytics.
✗Turn on blob versioning so every change to the storage account is searchable.Wrong answer — click to see why▾
Why this is wrong here
Blob versioning preserves previous versions of blobs, but it does not capture or store diagnostic logs (e.g., read/write operations) in a format queryable by KQL. Diagnostic settings must send logs to a Log Analytics workspace for KQL queries.
★ When this WOULD be the correct answer
If the question asked 'How to preserve previous versions of blobs for point-in-time recovery or auditing changes to blob data?', then enabling blob versioning would be the correct answer.
Why candidates choose this
Candidates may confuse blob versioning with log retention, thinking that versioning captures all changes including logs, or they may overgeneralize versioning as a catch-all for data preservation and queryability.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
KQL
Kusto Query Language is a powerful read-only query language used to explore, analyze, and visualize large datasets, most notably in Azure Data Explorer and Microsoft Sentinel.
Key term
Log Analytics workspace
A Log Analytics workspace is a unique environment in Azure Monitor where log data from various sources is collected, stored, and queried for analysis and reporting.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.