AZ-104 Monitor and Maintain Azure Resources Practice Question
Exhibit
Storage account: stprod01 Monitoring > Diagnostic settings Existing settings: none Metrics: Enabled Logs: Disabled Destination: not configured Requirement: retain operational logs in Log Analytics workspace law-prod
Based on the exhibit, you want the resource logs for the storage account to appear in Log Analytics so you can investigate read and write failures. What should you configure?
⚠ Common exam trap
Many candidates confuse metric alerts (which monitor performance metrics) with diagnostic settings (which collect detailed resource logs), leading them to choose a metric-based solution when the question explicitly asks for log data to investigate failures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a diagnostic setting that sends resource logs to the Log Analytics workspace.
Diagnostic settings in Azure allow you to stream resource logs (such as StorageRead and StorageWrite logs) from a storage account directly to a Log Analytics workspace. By configuring a diagnostic setting with the appropriate log categories enabled, you can query and analyze read and write failures in Log Analytics without additional infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a metric alert rule on the storage account and link it to an action group.
Why it's wrong here
A metric alert rule (e.g., on Transactions or Availability) evaluates Azure Monitor platform metrics at set intervals and only triggers an action group notification when a threshold is breached. It cannot capture or export individual storage read/write operations to Log Analytics because it does not generate or route resource logs. Diagnostic settings are the only mechanism that streams verbose platform logs to a workspace for querying.
When this WOULD be correct
You need to be notified when the average latency of a storage account exceeds a threshold for 5 minutes. In that case, creating a metric alert rule on the storage account and linking it to an action group (e.g., email or SMS) would be correct.
- ✓
Add a diagnostic setting that sends resource logs to the Log Analytics workspace.
Why this is correct
Diagnostic settings are the Azure Monitor feature used to route platform logs and metrics from a resource to destinations such as Log Analytics. Because the exhibit shows logs are disabled and no destination is configured, adding a diagnostic setting with the workspace selected is the correct way to make read and write events available for querying.
- ✗
Enable a resource lock so the storage account cannot be modified.
Why it's wrong here
A resource lock (CanNotDelete or ReadOnly) is an Azure Resource Manager governance control that prevents accidental deletion or modification of the storage account’s configuration and control plane operations. It has no influence on the telemetry path or data plane activity, and it does not enable or carry log records into Log Analytics. The lock only adds an authorization guard, not a data collection pipeline.
When this WOULD be correct
You would configure a resource lock if the question asked how to prevent accidental deletion or modification of a critical storage account, such as when implementing governance controls for a production resource.
- ✗
Move the storage account to a different subscription that already has Log Analytics enabled.
Why it's wrong here
Moving the storage account to a different subscription that already has a Log Analytics workspace does not establish any automatic log flow, because a workspace is a separate resource and diagnostic settings are scoped to the source resource. You would still need to manually add a diagnostic setting on the storage account and select the workspace as the destination. Additionally, subscription moves are subject to policy and may fail if the storage account has resource boundaries or service limits affecting the move.
When this WOULD be correct
If the question asked how to ensure that a storage account's logs are collected by a Log Analytics workspace in a different subscription, and you have already configured diagnostic settings, moving the storage account to that subscription might be a valid step to simplify management or meet compliance requirements.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Add a diagnostic setting that sends resource logs to the Log Analytics workspace.Correct answer▾
Why this is correct
Diagnostic settings are the Azure Monitor feature used to route platform logs and metrics from a resource to destinations such as Log Analytics. Because the exhibit shows logs are disabled and no destination is configured, adding a diagnostic setting with the workspace selected is the correct way to make read and write events available for querying.
✗Create a metric alert rule on the storage account and link it to an action group.Wrong answer — click to see why▾
Why this is wrong here
Metric alert rules monitor performance metrics (e.g., latency, throughput) and trigger actions, but they do not collect or send resource logs to Log Analytics. Resource logs require a diagnostic setting to be configured.
★ When this WOULD be the correct answer
You need to be notified when the average latency of a storage account exceeds a threshold for 5 minutes. In that case, creating a metric alert rule on the storage account and linking it to an action group (e.g., email or SMS) would be correct.
Why candidates choose this
Candidates may confuse metric alerts with diagnostic settings, thinking alerts can also collect log data, or they may assume that any monitoring configuration involving Log Analytics requires an alert rule.
✗Enable a resource lock so the storage account cannot be modified.Wrong answer — click to see why▾
Why this is wrong here
A resource lock prevents accidental deletion or modification of the storage account, but it does not collect or send resource logs to Log Analytics for investigating read and write failures.
★ When this WOULD be the correct answer
You would configure a resource lock if the question asked how to prevent accidental deletion or modification of a critical storage account, such as when implementing governance controls for a production resource.
Why candidates choose this
Candidates may confuse resource locks with diagnostic settings, thinking that locking the resource somehow secures or enables logging, or they may believe that a lock is required before logs can be sent.
✗Move the storage account to a different subscription that already has Log Analytics enabled.Wrong answer — click to see why▾
Why this is wrong here
Moving the storage account to a different subscription does not automatically send resource logs to Log Analytics; you still need to configure a diagnostic setting to stream logs to the workspace.
★ When this WOULD be the correct answer
If the question asked how to ensure that a storage account's logs are collected by a Log Analytics workspace in a different subscription, and you have already configured diagnostic settings, moving the storage account to that subscription might be a valid step to simplify management or meet compliance requirements.
Why candidates choose this
Candidates may think that moving to a subscription with Log Analytics enabled automatically enables logging, confusing subscription-level settings with resource-level diagnostic settings.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Diagnostic setting
A Diagnostic setting is a configuration in Azure that controls where and how resource logs and metrics are collected, stored, and streamed for monitoring and analysis.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A team wants to keep Azure platform logs for a storage account in a central location and analyze them with queries. The logs should be queryable together with other Azure resource logs. What destination should the administrator choose for the diagnostic setting?
easy- ✓ A.A Log Analytics workspace
- B.A storage account only
- C.An action group
- D.A management group
Why A: A Log Analytics workspace is the correct destination because it allows you to collect Azure platform logs (such as resource logs, activity logs, and metrics) from multiple resources into a central location. These logs can then be queried together using Kusto Query Language (KQL) across different resource types, enabling cross-resource analysis and correlation. This meets the requirement for queryable logs alongside other Azure resource logs.
Variation 2. You want to send a storage account's read, write, and delete events to a Log Analytics workspace for later investigation. Which feature should you configure?
easy- ✓ A.Diagnostic settings for the storage account
- B.An action group
- C.A metric alert rule
- D.A Recovery Services vault
Why A: Diagnostic settings on a storage account allow you to stream resource logs, including read, write, and delete operations (stored in the StorageRead, StorageWrite, and StorageDelete log categories), to a Log Analytics workspace. This is the correct feature for capturing and analyzing these events for later investigation.
Variation 3. A storage account's platform logs must be searchable later with KQL in a central workspace. Which two actions should the administrator take? Select two.
easy- ✓ A.Create a diagnostic setting on the storage account
- B.Configure a NAT gateway on the storage subnet
- ✓ C.Send the logs to a Log Analytics workspace
- D.Assign the Reader role on the subscription
- E.Enable a VM backup policy
Why A: A diagnostic setting on the storage account is required to route platform logs (e.g., storage read/write/delete operations) to a destination. Option C is correct because a Log Analytics workspace is the destination that enables KQL-based searching and analysis of those logs. Without both, the logs cannot be stored in a central, queryable repository.
Variation 4. You want to send a storage account's platform logs to a workspace so they can be queried with KQL later. Which two items are part of the required configuration? Select two.
easy- ✓ A.Diagnostic settings on the storage account
- ✓ B.A Log Analytics workspace
- C.A network security group
- D.A Recovery Services vault
- E.An availability zone assignment
Why A: A is correct because diagnostic settings on the storage account are the mechanism that defines which platform logs (e.g., storage read/write/delete operations) are collected and where they are sent. Without configuring diagnostic settings, the storage account does not emit logs to any destination. B is correct because a Log Analytics workspace is the required destination for storing the logs so they can be queried with KQL; it provides the ingestion and retention infrastructure for log analytics.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.