During a compliance review, the team must distinguish what each Azure Monitor object can and cannot do. Match each object to its primary operational scope.
Drag a concept onto its matching description — or click a concept then click the description.
Evaluates resource performance data such as CPU, latency, or disk metrics.
Watches subscription-level control-plane events such as deletes or policy changes.
Runs a KQL query against workspace data and alerts on the result.
Exports resource telemetry off the resource for storage or analysis.
Serves as the reusable response target for notifications and automation.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Metrics: Collects numeric time-series data for performance and health.
Metrics collect numeric time-series data; Logs collect text logs for querying; Application Insights monitors web apps; Activity Log records subscription events; Diagnostic Logs capture resource logs; Service Health provides service incident info.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Metrics: Collects numeric time-series data for performance and health.
Why this is correct
Metrics in Azure Monitor are lightweight numeric values sampled at regular intervals, forming time-series data that capture performance and health indicators such as CPU utilization, memory percentage, and disk I/O. These values are stored in a time-series database optimized for near-real-time monitoring, enabling rapid threshold-based alerting and autoscale rules. Unlike logs, metrics do not support complex text queries but are ideal for calculating averages, percentiles, and long-term trends.
Logs: Collects text-based log data for querying and analysis.
Why this is correct
Logs in Azure Monitor ingest structured and unstructured text-based records from sources like application traces, Windows/Linux event logs, and custom telemetry. These records are stored in a Log Analytics workspace and can be queried using the Kusto Query Language (KQL) for deep correlation, trend analysis, and forensic investigations. Logs enable combining data across resources and time ranges, making them well-suited for complex diagnostics and root-cause analysis that numeric metrics alone cannot provide.
Application Insights: Monitors web applications and provides diagnostics.
Why this is correct
Application Insights is an Application Performance Management (APM) service that provides real-time monitoring of live web applications, detecting anomalies and offering deep diagnostics for issues like failed requests, dependency bottlenecks, and page load performance. It automatically collects telemetry such as requests, exceptions, and custom events, and integrates with development pipelines to support continuous monitoring and deployment. This service is part of Azure Monitor and leverages both metrics and logs, giving developers a unified view of an application's health, usage, and failure modes.
Activity Log: Captures resource-level logs from Azure resources.
Why it's wrong here
This statement is incorrect because the Activity Log records subscription-level events, such as administrative changes, resource creation or deletion, and security policy evaluations, not resource-level operational data. Resource-level logs are captured via Diagnostic Settings and are known as Diagnostic Logs, which contain instance-specific information like network flow logs, application gateway performance, or Key Vault audit trails. Conflating Activity Log with resource-level capture misrepresents its subscription-scoped role as the control-plane audit trail of Azure.
Diagnostic Logs: Records subscription-level events and operations.
Why it's wrong here
This description is backwards: Diagnostic Logs are resource-level logs that capture granular operational data from a specific Azure resource, such as Azure Firewall flow logs, Logic App workflow runs, or Key Vault audit events. In contrast, subscription-level events and operations are recorded by the Activity Log, which includes actions like virtual machine creation, role assignment changes, and service health incidents. The given statement confuses the two scopes, incorrectly implying that Diagnostic Logs operate at a higher level than they actually do.
Service Health: Monitors web applications and provides diagnostics.
Why it's wrong here
Service Health does not monitor web applications; it provides a personalized dashboard and alerts about Azure service incidents, planned maintenance, and health advisories that affect your tenant or subscriptions. Monitoring web applications and providing diagnostics is the role of Application Insights, which tracks application-level performance, errors, and user behavior. Thus, this option inaccurately assigns Application Insights' capabilities to Service Health, which focuses on the health of the Azure platform rather than your own deployed applications.
Go deeper
Learn chapter
Managed Identities for Azure Resources
Key term
Application Insights
Application Insights is an Azure monitoring service that helps developers detect, diagnose, and understand issues in live web applications by collecting telemetry data like requests, exceptions, and performance counters.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.