AZ-104 Monitor and Maintain Azure Resources Practice Question
You need to collect Windows event logs and performance counters from multiple Azure virtual machines and query the data by using Kusto Query Language. Which Azure resource should you use?
⚠ Common exam trap
Candidates often confuse a Log Analytics workspace with Azure Monitor itself, but the workspace is the specific resource that stores and queries the data, while Azure Monitor is the overarching service; the question explicitly asks for the resource that collects and queries the data, which is the workspace.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Log Analytics workspace
A Log Analytics workspace is the correct Azure resource for collecting Windows event logs and performance counters from Azure VMs and querying them using Kusto Query Language (KQL). It serves as the central repository where diagnostic data is ingested via the Azure Diagnostics extension or the Log Analytics agent, enabling rich log analytics and custom KQL queries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A Log Analytics workspace
Why this is correct
A Log Analytics workspace is the correct destination because it acts as Azure Monitor's centralized data repository for telemetry such as Windows event logs (collected in the Event table) and performance counters (stored in the Perf table). The Azure Monitor Agent (or legacy Log Analytics agent) sends this VM data to the workspace, where it can be analyzed using KQL queries, visualized in workbooks, and used to trigger alerts. Without a workspace, you cannot run log analytics queries over these OS-level metrics and events.
- ✗
A Recovery Services vault
Why it's wrong here
A Recovery Services vault is the backing service for Azure Backup and Azure Site Recovery; it stores recovery points, snapshots, and replication data for protected workloads. It does not collect real-time Windows event logs or performance counters, nor does it expose the data to KQL queries for operational analytics. Its purpose is to facilitate restore and DR operations, not to serve as a repository for VM telemetry, making it an invalid choice for log analytics scenarios.
When this WOULD be correct
You need to back up Azure virtual machines and restore files or folders from a backup. In that scenario, a Recovery Services vault is the correct resource to manage backups and perform restores.
- ✗
Azure Network Watcher
Why it's wrong here
Azure Network Watcher is a network-focused monitoring and diagnostics service, not a log analytics store. It provides capabilities like Connection Monitor, packet capture, and NSG flow logs, which record network traffic and connectivity stats rather than Windows events or performance counters from the guest OS. While flow logs can be sent to a storage account or Log Analytics workspace, Network Watcher itself does not ingest or store VM OS telemetry, and it lacks the KQL-based querying and centralized analytics that a Log Analytics workspace provides.
When this WOULD be correct
When the question asks for a tool to capture network traffic, diagnose connectivity issues, or monitor network performance between Azure VMs, Azure Network Watcher would be the correct answer.
- ✗
A load balancer
Why it's wrong here
Azure Load Balancer is a Layer 4 (TCP/UDP) load balancing service that distributes incoming traffic to backend pool instances; it does not store or analyze Windows event logs or performance counters. While you can configure diagnostic settings for Load Balancer to emit its own metrics to a Log Analytics workspace, the load balancer itself is merely a source of network telemetry, not a data store or query engine. It cannot collect guest OS data from VMs, so it fails to meet the requirement for centralized VM log and performance collection.
When this WOULD be correct
You need to distribute incoming traffic across multiple virtual machines to ensure high availability and fault tolerance for a web application. In that scenario, an Azure load balancer would be the correct resource.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Log Analytics workspaceCorrect answer▾
Why this is correct
A Log Analytics workspace is the correct destination because it acts as Azure Monitor's centralized data repository for telemetry such as Windows event logs (collected in the Event table) and performance counters (stored in the Perf table). The Azure Monitor Agent (or legacy Log Analytics agent) sends this VM data to the workspace, where it can be analyzed using KQL queries, visualized in workbooks, and used to trigger alerts. Without a workspace, you cannot run log analytics queries over these OS-level metrics and events.
✗A Recovery Services vaultWrong answer — click to see why▾
Why this is wrong here
A Recovery Services vault is used for backup and disaster recovery, not for collecting and querying Windows event logs and performance counters with Kusto Query Language.
★ When this WOULD be the correct answer
You need to back up Azure virtual machines and restore files or folders from a backup. In that scenario, a Recovery Services vault is the correct resource to manage backups and perform restores.
Why candidates choose this
Candidates may confuse the data collection and querying capabilities of Log Analytics with the backup and recovery functions of Recovery Services vaults, especially since both involve managing data from VMs.
✗Azure Network WatcherWrong answer — click to see why▾
Why this is wrong here
Azure Network Watcher is used for network monitoring and diagnostics, not for collecting and querying Windows event logs and performance counters with KQL.
★ When this WOULD be the correct answer
When the question asks for a tool to capture network traffic, diagnose connectivity issues, or monitor network performance between Azure VMs, Azure Network Watcher would be the correct answer.
Why candidates choose this
Candidates may confuse Network Watcher's monitoring capabilities with log collection, assuming it can gather event logs and performance data, but its scope is limited to network-level metrics and packet captures.
✗A load balancerWrong answer — click to see why▾
Why this is wrong here
A load balancer distributes network traffic and does not collect or store Windows event logs or performance counters, nor does it support Kusto Query Language queries.
★ When this WOULD be the correct answer
You need to distribute incoming traffic across multiple virtual machines to ensure high availability and fault tolerance for a web application. In that scenario, an Azure load balancer would be the correct resource.
Why candidates choose this
Candidates may confuse load balancers with monitoring tools because load balancers can be associated with health probes and metrics, leading them to incorrectly assume it can collect and query log data.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Log Analytics workspace
A Log Analytics workspace is a unique environment in Azure Monitor where log data from various sources is collected, stored, and queried for analysis and reporting.
Key term
Kusto Query Language
Kusto Query Language (KQL) is a read-only, high-performance query language used to analyze large datasets, especially for log monitoring, security investigations, and operational analytics in Microsoft Azure.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.