AZ-104 Monitor and Maintain Azure Resources Practice Question
You need to collect performance counters and event logs from multiple Azure virtual machines and query the data centrally by using Kusto Query Language. Which Azure resource should you deploy?
⚠ Common exam trap
Many exam-takers confuse Azure Monitor with Azure Backup or network monitoring tools, mistakenly thinking a Recovery Services vault or Network Watcher can store and query log data, when in fact only a Log Analytics workspace provides the centralized KQL-based querying capability for performance counters and event logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Log Analytics workspace
A Log Analytics workspace is the correct Azure resource because it ingests performance counters and event logs from Azure virtual machines via the Azure Monitor agent or the legacy Log Analytics agent, and stores them in a centralized repository. You can then query this data using Kusto Query Language (KQL) to perform real-time analysis, troubleshooting, and reporting across multiple VMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A Log Analytics workspace
Why this is correct
A Log Analytics workspace is the central data repository for Azure Monitor Logs. It can natively ingest performance counters and event logs from multiple VMs and other resources via the Azure Monitor Agent or the legacy Log Analytics agent, making it the correct destination for KQL-based analysis. All log and metric data collected from diverse sources is stored here, enabling unified queries, alerting, and visualization.
- ✗
A Recovery Services vault
Why it's wrong here
A Recovery Services vault is a management container for Azure Backup and Azure Site Recovery data, holding backup snapshots, recovery points, and replication metadata. Its purpose is to support data protection and disaster recovery workflows, not to collect or analyze operational telemetry. While backup reports can be sent to a Log Analytics workspace, the vault itself does not store or query performance counters or event logs from multiple sources.
When this WOULD be correct
You need to back up Azure virtual machines and restore them in case of data loss or disaster. Deploy a Recovery Services vault to manage backups and perform restores.
- ✗
Azure Network Watcher
Why it's wrong here
Azure Network Watcher provides network-specific diagnostic tools such as NSG flow logs, connection monitors, and packet capture to troubleshoot IP connectivity and network performance issues. It is not a general-purpose log analytics platform and does not aggregate performance counters or system event logs from guest operating systems. Its data is focused on network-level telemetry and is not designed to support broad KQL-based queries across heterogeneous VM workloads.
When this WOULD be correct
You need to monitor network traffic between Azure VMs, diagnose connectivity issues, or capture packets for analysis. For example, a question asking 'Which Azure resource should you use to enable Network Performance Monitor or to capture network packets from a VM?' would make Network Watcher the correct answer.
- ✗
A load balancer
Why it's wrong here
An Azure Load Balancer operates at layer 4 of the OSI model and is designed to distribute incoming network traffic among healthy backend endpoints. It does not ingest, store, or process performance counters or event logs from VMs; its own diagnostic metrics are limited to load-balancer-specific statistics like packet counts and health probe status. Without any log analytics schema or query capability, it cannot function as a centralized repository for KQL analysis.
When this WOULD be correct
You need to distribute incoming internet traffic across multiple Azure virtual machines to ensure high availability and fault tolerance. Deploy a load balancer to route traffic based on rules and health probes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Log Analytics workspaceCorrect answer▾
Why this is correct
A Log Analytics workspace is the central data repository for Azure Monitor Logs. It can natively ingest performance counters and event logs from multiple VMs and other resources via the Azure Monitor Agent or the legacy Log Analytics agent, making it the correct destination for KQL-based analysis. All log and metric data collected from diverse sources is stored here, enabling unified queries, alerting, and visualization.
✗A Recovery Services vaultWrong answer — click to see why▾
Why this is wrong here
A Recovery Services vault is used for backup and disaster recovery, not for collecting and querying performance counters and event logs with Kusto Query Language.
★ When this WOULD be the correct answer
You need to back up Azure virtual machines and restore them in case of data loss or disaster. Deploy a Recovery Services vault to manage backups and perform restores.
Why candidates choose this
Candidates may confuse Recovery Services vault with Log Analytics workspace because both are Azure resources that deal with data, but they serve different purposes—backup vs. monitoring and analytics.
✗Azure Network WatcherWrong answer — click to see why▾
Why this is wrong here
Azure Network Watcher provides network monitoring and diagnostics (e.g., packet capture, NSG flow logs), but it does not collect performance counters or event logs, nor does it support querying data with Kusto Query Language (KQL).
★ When this WOULD be the correct answer
You need to monitor network traffic between Azure VMs, diagnose connectivity issues, or capture packets for analysis. For example, a question asking 'Which Azure resource should you use to enable Network Performance Monitor or to capture network packets from a VM?' would make Network Watcher the correct answer.
Why candidates choose this
Candidates may confuse Network Watcher's monitoring capabilities with general log collection, or assume that any Azure monitoring tool can handle performance counters and event logs, overlooking the specific KQL requirement that only Log Analytics workspaces fulfill.
✗A load balancerWrong answer — click to see why▾
Why this is wrong here
A load balancer distributes network traffic across virtual machines; it does not collect performance counters or event logs, nor does it support querying data with Kusto Query Language.
★ When this WOULD be the correct answer
You need to distribute incoming internet traffic across multiple Azure virtual machines to ensure high availability and fault tolerance. Deploy a load balancer to route traffic based on rules and health probes.
Why candidates choose this
Candidates may confuse load balancers with monitoring tools because load balancers provide metrics and logs, but these are limited and not designed for centralized querying with KQL.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Log Analytics workspace
A Log Analytics workspace is a unique environment in Azure Monitor where log data from various sources is collected, stored, and queried for analysis and reporting.
Key term
Azure Monitor
Azure Monitor is a cloud service that collects, analyzes, and acts on telemetry data from your Azure and on-premises resources to help you understand performance and availability.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.