AZ-104 Monitor and Maintain Azure Resources Practice Question
You need to collect guest operating system performance counters and Windows event logs from several Azure virtual machines into a central queryable platform. Which Azure component should you configure?
⚠ Common exam trap
Watch out — candidates often confuse a Log Analytics workspace with a Recovery Services vault, mistakenly thinking that backup vaults can also store and query performance data, when in fact Recovery Services vaults are solely for backup and disaster recovery operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Log Analytics workspace
A Log Analytics workspace is the correct Azure component for collecting guest OS performance counters and Windows event logs from Azure VMs. It serves as a central repository where diagnostic data from Azure Monitor agents (such as the Log Analytics agent or Azure Monitor Agent) is ingested, stored, and made available for querying via Kusto Query Language (KQL). This enables you to analyze performance metrics and event logs across multiple VMs in a unified, queryable platform.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A Log Analytics workspace
Why this is correct
A Log Analytics workspace is the required destination for guest OS performance counters and Windows event logs. The Azure Monitor Agent (or legacy Log Analytics agent) streams this telemetry into the workspace, where it can be queried with KQL, visualized in workbooks, and retained according to your data retention policies. Without a workspace, there is no centralized repository for the collected metrics and logs, making alerting and diagnostics impossible.
- ✗
A Recovery Services vault
Why it's wrong here
A Recovery Services vault is exclusively designed for backup and disaster recovery, storing recovery points for Azure VMs, SQL Server databases, and other protected workloads. It does not ingest runtime performance counters or Windows event logs, nor does it provide any query or analytics capability for guest OS telemetry. Sending guest OS monitoring data to a Recovery Services vault is conceptually incorrect because its data plane is built for restore operations, not log aggregation.
When this WOULD be correct
When the question asks for a solution to back up Azure VMs or replicate them to another region for disaster recovery, a Recovery Services vault would be the correct component to configure.
- ✗
An Azure Policy initiative
Why it's wrong here
An Azure Policy initiative is a governance tool that bundles multiple policy definitions to enforce compliance rules, such as requiring the Azure Monitor agent or configuring diagnostic settings on VMs. While policy can mandate that collection be enabled, it is not a storage or ingestion service—performance counters and event logs are never routed to policy. The actual telemetry flow terminates in a Log Analytics workspace, with policy serving only as a guardrail to ensure that configuration is applied.
When this WOULD be correct
You need to ensure that all virtual machines in a subscription have a specific diagnostic extension deployed and configured. An Azure Policy initiative can be assigned to audit or deploy the extension automatically.
- ✗
A route table
Why it's wrong here
A route table contains user-defined routes (UDRs) that control the next-hop path for network packets within an Azure virtual network, such as directing traffic to an NVA or forced tunneling to on-premises. It is a network abstraction layer with no storage, ingestion, or processing capability for guest OS performance data or Windows event logs. These logs originate from the VM's operating system and must be sent to a data-collection endpoint like a Log Analytics workspace, not to a network routing resource.
When this WOULD be correct
When the question asks how to force all outbound traffic from a subnet to go through a network virtual appliance (NVA) for inspection, a route table with a user-defined route (UDR) to the NVA is the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Log Analytics workspaceCorrect answer▾
Why this is correct
A Log Analytics workspace is the required destination for guest OS performance counters and Windows event logs. The Azure Monitor Agent (or legacy Log Analytics agent) streams this telemetry into the workspace, where it can be queried with KQL, visualized in workbooks, and retained according to your data retention policies. Without a workspace, there is no centralized repository for the collected metrics and logs, making alerting and diagnostics impossible.
✗A Recovery Services vaultWrong answer — click to see why▾
Why this is wrong here
A Recovery Services vault is used for backup and disaster recovery (Azure Backup and Site Recovery), not for collecting guest OS performance counters and event logs into a queryable platform.
★ When this WOULD be the correct answer
When the question asks for a solution to back up Azure VMs or replicate them to another region for disaster recovery, a Recovery Services vault would be the correct component to configure.
Why candidates choose this
Candidates may confuse the 'vault' concept with a centralized storage or logging repository, or think that backup services also collect performance data.
✗An Azure Policy initiativeWrong answer — click to see why▾
Why this is wrong here
An Azure Policy initiative is used to enforce organizational policies and compliance rules across resources, not to collect and query guest OS performance counters and event logs.
★ When this WOULD be the correct answer
You need to ensure that all virtual machines in a subscription have a specific diagnostic extension deployed and configured. An Azure Policy initiative can be assigned to audit or deploy the extension automatically.
Why candidates choose this
Candidates may confuse policy-based compliance enforcement with data collection, thinking that a policy initiative can gather monitoring data, when in fact it only evaluates or deploys configurations.
✗A route tableWrong answer — click to see why▾
Why this is wrong here
A route table controls network traffic routing between subnets and does not collect or store guest OS performance counters or event logs.
★ When this WOULD be the correct answer
When the question asks how to force all outbound traffic from a subnet to go through a network virtual appliance (NVA) for inspection, a route table with a user-defined route (UDR) to the NVA is the correct answer.
Why candidates choose this
Candidates may confuse network-level data collection (like flow logs) with guest OS data collection, or think that route tables can be used to direct monitoring traffic to a central location.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Log Analytics workspace
A Log Analytics workspace is a unique environment in Azure Monitor where log data from various sources is collected, stored, and queried for analysis and reporting.
Key term
Azure Monitor
Azure Monitor is a cloud service that collects, analyzes, and acts on telemetry data from your Azure and on-premises resources to help you understand performance and availability.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.