AZ-104 Monitor and Maintain Azure Resources Practice Question
A team wants to keep Azure platform logs for a storage account in a central location and analyze them with queries. The logs should be queryable together with other Azure resource logs. What destination should the administrator choose for the diagnostic setting?
⚠ Common exam trap
Candidates often confuse a storage account as a valid destination for log analysis because it can store logs, but they overlook that it lacks native querying capabilities and cannot integrate with other resource logs for cross-analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Log Analytics workspace
A Log Analytics workspace is the correct destination because it allows you to collect Azure platform logs (such as resource logs, activity logs, and metrics) from multiple resources into a central location. These logs can then be queried together using Kusto Query Language (KQL) across different resource types, enabling cross-resource analysis and correlation. This meets the requirement for queryable logs alongside other Azure resource logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A Log Analytics workspace
Why this is correct
A Log Analytics workspace is the correct destination because it ingests Azure platform logs into a centralized, queryable store. It enables cross-resource correlation with KQL, supports alerts, workbooks, and retains logs based on configurable retention policies, making it the standard for consolidated monitoring and troubleshooting across subscriptions and resources.
- ✗
A storage account only
Why it's wrong here
Archiving logs to a storage account only provides cold, object-based storage for compliance or long-term retention, but it does not enable interactive querying or alerting. You would need to export logs to a storage account for archival purposes and then use separate tooling to parse blobs, whereas a Log Analytics workspace gives immediate KQL query capabilities over the same data.
When this WOULD be correct
When the requirement is to archive logs for long-term retention or compliance at low cost, and querying is not needed (e.g., logs must be kept for 7 years and accessed only occasionally via download).
- ✗
An action group
Why it's wrong here
An action group is a notification and response mechanism, not a log destination. It defines who receives alerts (email, SMS, push) and what automated actions occur (for example, webhooks or ITSM tickets) when a metric alert or service health警报 fires. It has no capacity to ingest, store, or analyze platform logs, so it cannot serve as a central log repository.
When this WOULD be correct
In a scenario where the goal is to send an alert (e.g., when a specific error appears in logs) or trigger an automated response (e.g., runbook) based on a log metric, an action group would be the correct destination for the alert rule, not the diagnostic setting.
- ✗
A management group
Why it's wrong here
A management group is an Azure governance container used to organize and manage multiple subscriptions through Azure Policy and RBAC inheritance. It does not ingest, store, or process any operational or diagnostic data. Platform logs are emitted by resources and must be routed to explicit data destinations like Log Analytics, Event Hubs, or storage, not to a management group.
When this WOULD be correct
When the question asks about the scope for applying Azure Policy or RBAC assignments across multiple subscriptions, a management group would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Log Analytics workspaceCorrect answer▾
Why this is correct
A Log Analytics workspace is the correct destination because it ingests Azure platform logs into a centralized, queryable store. It enables cross-resource correlation with KQL, supports alerts, workbooks, and retains logs based on configurable retention policies, making it the standard for consolidated monitoring and troubleshooting across subscriptions and resources.
✗A storage account onlyWrong answer — click to see why▾
Why this is wrong here
A storage account only stores logs as blobs, which cannot be queried directly with KQL or analyzed alongside other resource logs in a unified query environment.
★ When this WOULD be the correct answer
When the requirement is to archive logs for long-term retention or compliance at low cost, and querying is not needed (e.g., logs must be kept for 7 years and accessed only occasionally via download).
Why candidates choose this
Candidates may think storing logs in a storage account is sufficient for analysis, overlooking that Log Analytics workspace provides the querying and cross-resource analysis capabilities explicitly required.
✗An action groupWrong answer — click to see why▾
Why this is wrong here
An action group is used to send notifications (e.g., email, SMS) or trigger automated actions based on alerts, not to store or query logs. It cannot serve as a destination for diagnostic settings to collect logs for querying.
★ When this WOULD be the correct answer
In a scenario where the goal is to send an alert (e.g., when a specific error appears in logs) or trigger an automated response (e.g., runbook) based on a log metric, an action group would be the correct destination for the alert rule, not the diagnostic setting.
Why candidates choose this
Candidates may confuse action groups with log destinations because both are related to monitoring and alerts, but action groups handle notifications/actions, not log storage or querying.
✗A management groupWrong answer — click to see why▾
Why this is wrong here
A management group is a container for managing access, policies, and compliance across multiple subscriptions, not a destination for diagnostic logs. It cannot store or query log data.
★ When this WOULD be the correct answer
When the question asks about the scope for applying Azure Policy or RBAC assignments across multiple subscriptions, a management group would be the correct answer.
Why candidates choose this
Candidates may confuse 'management group' with 'log analytics workspace' as both are hierarchical containers, or think that a management group can aggregate logs from multiple subscriptions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
KQL
Kusto Query Language is a powerful read-only query language used to explore, analyze, and visualize large datasets, most notably in Azure Data Explorer and Microsoft Sentinel.
Key term
Diagnostic setting
A Diagnostic setting is a configuration in Azure that controls where and how resource logs and metrics are collected, stored, and streamed for monitoring and analysis.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.