AZ-104 Monitor and Maintain Azure Resources Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'Microsoft.Storage/storageAccounts/delete' | where ActivityStatusValue == 'Failed' | summarize Failures=count() by Caller

  Why this is correct

  The query correctly scopes to the AzureActivity table, which records Azure Resource Manager control-plane operations, then applies a 1-hour TimeGenerated filter to narrow the window. It uses the `has` operator to match the exact resource-provider operation string for storage account deletion, followed by an ActivityStatusValue of 'Failed' to isolate only unsuccessful attempts. The final summarize groups by Caller and counts each failed deletion, producing a per-identity failure count that directly answers the incident investigation. This pipeline is efficient because filters are applied before aggregation, reducing the dataset to the relevant failed deletes.

• ✗

  AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'Microsoft.Storage/storageAccounts/delete' | where ActivityStatusValue == 'Succeeded' | summarize Failures=count() by Caller

  Why it's wrong here

  This query is almost identical to the correct one but inverts the status filter to ActivityStatusValue == 'Succeeded', so it returns only deletions that completed successfully. Because the incident response team needs to identify who attempted failed deletes, this query produces the opposite set of records—missing every failure and instead counting successful operations. The summarize alias 'Failures' is also misleading, as the count would represent successful deletions, not failures. Consequently, the query yields no actionable information about the reported failed delete attempts.

  When this WOULD be correct

  This option would be correct if the question asked to count successful storage account delete operations by caller in the last hour.

• ✗

  SecurityEvent | where EventID == 4670 | summarize count() by Account

  Why it's wrong here

  SecurityEvent is a table that stores Windows operating system security events collected from virtual machines, not Azure resource activity logs. EventID 4670 corresponds to 'Permissions on an object were changed' in Windows auditing, which is unrelated to Azure Storage account deletion operations. This query also lacks any time-based filter and groups by Account, which is a local Windows account field rather than the Azure AD Caller identity. As a result, it would return zero relevant rows for the incident and demonstrates a fundamental misunderstanding of where Azure control-plane events are logged.

  When this WOULD be correct

  This query would be correct for a question asking: 'Which KQL query should you use to find all permission change events (EventID 4670) in the last hour, grouped by account?'

• ✗

  AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'Microsoft.Storage/storageAccounts/delete' | summarize Failures=count() by Caller

  Why it's wrong here

  This query omits the ActivityStatusValue filter entirely, so it aggregates every deletion attempt in the last hour, including both successful and failed operations. The summarize alias 'Failures' is a misnomer because the count would represent the total number of delete attempts, not the number of failures. This would overreport the metric and make it impossible to distinguish callers whose deletions failed from those that succeeded. Without the status filter, the query cannot answer the specific question about failed attempts and would mislead the incident response team into investigating a much broader set of events.

  When this WOULD be correct

  If the question asked to count all storage account delete operations (both successful and failed) in the last hour by caller, this query would be correct because it omits the status filter.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question