AZ-104 Monitor and Maintain Azure Resources Practice Question
Engineers need a single Log Analytics workspace to investigate incidents by querying Windows event logs from a VM and Azure resource logs from a storage account. What should the administrator configure?
⚠ Common exam trap
Many exam-takers confuse availability sets (a VM high-availability feature) with log aggregation, or assume that a resource lock or private endpoint somehow enables data collection, when in fact only proper data collection agents and diagnostic settings can route logs to a workspace.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Monitor Agent with a data collection rule for the VM and diagnostic settings for the storage account, both sending data to the same workspace.
Azure Monitor Agent (AMA) with a data collection rule (DCR) collects Windows event logs from VMs, and diagnostic settings on a storage account send Azure resource logs to the same Log Analytics workspace. This centralizes both data sources for unified querying and incident investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a resource lock on the workspace and let each team send emails when incidents happen.
Why it's wrong here
A resource lock such as CanNotDelete or ReadOnly protects the workspace from accidental deletion or modification, yet it does not ingest logs or enable querying. Relying on team emails fragments incident data into unsearchable messages and bypasses the structured KQL correlation the engineers need. The requirement is a single log analytics workspace for investigation, which only data collection rules and diagnostic settings can populate.
When this WOULD be correct
An administrator needs to prevent deletion of a critical Log Analytics workspace that stores compliance data; creating a resource lock (e.g., CanNotDelete) ensures the workspace remains intact.
- ✓
Use Azure Monitor Agent with a data collection rule for the VM and diagnostic settings for the storage account, both sending data to the same workspace.
Why this is correct
VM guest logs require the Azure Monitor Agent and a data collection rule, while storage account platform logs are exported with diagnostic settings. Sending both to one Log Analytics workspace gives the team a single place to correlate incidents with KQL.
- ✗
Move the VM and storage account into the same availability set so their logs appear together.
Why it's wrong here
Availability sets are a VM resiliency construct that spreads VM instances across fault domains and update domains, but they have no role in telemetry delivery. A storage account cannot even be added to an availability set, and its platform logs remain in a separate diagnostic destination until explicitly routed. Centralized investigation requires both resources to send data to the same Log Analytics workspace; physical or logical co-location does not aggregate logs.
When this WOULD be correct
In a question asking how to ensure high availability for a multi-tier application by placing VMs in different fault domains and update domains, configuring an availability set would be the correct answer.
- ✗
Enable a private endpoint for the workspace and disable all diagnostic collection.
Why it's wrong here
A private endpoint on the Log Analytics workspace provides secure network connectivity to its ingestion and query APIs, but it is a network control, not a data collection mechanism. Disabling diagnostic collection would stop the flow of platform logs from the storage account and guest logs from the VM, leaving the workspace empty for investigation. The correct design is to enable Azure Monitor Agent with a DCR for the VM and diagnostic settings for the storage account while using the private endpoint for secure access.
When this WOULD be correct
When the requirement is to ensure secure and private connectivity to a Log Analytics workspace while restricting data collection to only authorized sources, such as in a highly regulated environment where data exfiltration must be prevented.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use Azure Monitor Agent with a data collection rule for the VM and diagnostic settings for the storage account, both sending data to the same workspace.Correct answer▾
Why this is correct
VM guest logs require the Azure Monitor Agent and a data collection rule, while storage account platform logs are exported with diagnostic settings. Sending both to one Log Analytics workspace gives the team a single place to correlate incidents with KQL.
✗Create a resource lock on the workspace and let each team send emails when incidents happen.Wrong answer — click to see why▾
Why this is wrong here
Resource locks prevent accidental deletion or modification but do not collect or centralize logs; they cannot enable querying Windows event logs and Azure resource logs in a single workspace.
★ When this WOULD be the correct answer
An administrator needs to prevent deletion of a critical Log Analytics workspace that stores compliance data; creating a resource lock (e.g., CanNotDelete) ensures the workspace remains intact.
Why candidates choose this
Candidates may confuse resource locks with access control or think locking helps manage log collection, overlooking that locks only protect resources, not aggregate data.
✗Move the VM and storage account into the same availability set so their logs appear together.Wrong answer — click to see why▾
Why this is wrong here
Availability sets are used for VM high availability, not for aggregating logs from different Azure resources into a single Log Analytics workspace.
★ When this WOULD be the correct answer
In a question asking how to ensure high availability for a multi-tier application by placing VMs in different fault domains and update domains, configuring an availability set would be the correct answer.
Why candidates choose this
Candidates may confuse the concept of grouping resources for availability with the need to group logs for analysis, assuming that placing resources together in an availability set also consolidates their logs.
✗Enable a private endpoint for the workspace and disable all diagnostic collection.Wrong answer — click to see why▾
Why this is wrong here
Disabling all diagnostic collection would prevent sending Azure resource logs from the storage account and Windows event logs from the VM to the Log Analytics workspace, making incident investigation impossible.
★ When this WOULD be the correct answer
When the requirement is to ensure secure and private connectivity to a Log Analytics workspace while restricting data collection to only authorized sources, such as in a highly regulated environment where data exfiltration must be prevented.
Why candidates choose this
Candidates may think that enabling a private endpoint enhances security and that disabling diagnostic collection simplifies management, not realizing it eliminates the data needed for analysis.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Log Analytics workspace
A Log Analytics workspace is a unique environment in Azure Monitor where log data from various sources is collected, stored, and queried for analysis and reporting.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.