AZ-104 Monitor and Maintain Azure Resources Practice Question
You need to monitor CPU on a small set of VMs while keeping ingestion costs low. Which two actions are the best choices? Select two.
⚠ Common exam trap
Many candidates assume guest-level logging is required for CPU monitoring, but Azure Monitor platform metrics already provide host-level CPU data at no extra cost, making options like verbose logging or full event collection unnecessary and costly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Monitor platform metrics for CPU instead of collecting guest logs
Azure Monitor platform metrics for CPU are collected automatically from the Azure VM host at no additional cost, providing basic CPU utilization data without requiring the Log Analytics agent or incurring data ingestion charges. This approach keeps costs low because platform metrics are included in the Azure Monitor pricing, whereas guest-level metrics require log ingestion and storage fees. For a small set of VMs where only CPU monitoring is needed, platform metrics are sufficient and cost-effective.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Azure Monitor platform metrics for CPU instead of collecting guest logs
Why this is correct
Azure Monitor platform metrics for CPU are automatically collected for Azure VMs at no additional Log Analytics ingestion cost, and they are stored in the Azure metrics database which supports near-real-time alerting and charting. Guest-level logs require the Azure Monitor Agent, incurring per-GB ingestion fees and ongoing agent management. Because CPU percentage is a host-side metric, platform metrics provide exactly the data needed without sending any log data, making this the most cost-effective choice.
- ✓
Collect only the required diagnostic categories and performance counters
Why this is correct
When guest-level monitoring is required, limiting data collection to only the needed diagnostic categories and performance counters, such as \Processor Information(_Total)\% Processor Time, dramatically reduces the volume of telemetry sent to Log Analytics. This practice avoids paying for ingestion of hundreds of unused counters or irrelevant event logs. It is a correct, cost-conscious approach that still delivers the required CPU visibility, especially when combined with metric alerts rather than log search alerts.
- ✗
Collect all Windows event logs from every VM
Why it's wrong here
Collecting all Windows event logs—including System, Application, Security, and Setup—from every VM produces high-volume data ingestion, as most events are unrelated to CPU performance and are never queried for this use case. This inflates Azure Monitor costs and storage requirements, violating the low-cost monitoring objective. For monitoring CPU, you need metrics, not event logs, so this broad collection is wasteful and technically inappropriate.
When this WOULD be correct
If the question required comprehensive security auditing or compliance monitoring where all event logs must be retained for forensic analysis, and cost was not a constraint, then collecting all logs would be appropriate.
- ✗
Create a separate workspace for each VM
Why it's wrong here
Creating a separate Log Analytics workspace per VM does not reduce the total amount of data ingested; billing is based on overall ingestion volume, so splitting workspaces leaves costs unchanged while fragmenting your monitoring data. It also increases management overhead by requiring multiple workspace keys, separate agent configurations, and more complex cross-VM queries or dashboards. For a small set of VMs, a single workspace is simpler, lowers administrative effort, and does not affect CPU monitoring capability.
When this WOULD be correct
If the question required strict data isolation for compliance or security reasons (e.g., each VM belongs to a different client with separate data boundaries), then separate workspaces would be correct despite higher costs.
- ✗
Enable verbose guest logging on every server
Why it's wrong here
Verbose guest logging captures debug-level events and traces for every application and service, which can generate gigabytes of data per VM per day and significantly increase Log Analytics ingestion costs. For simple CPU monitoring, you do not need this level of detail; platform metrics or a few targeted performance counters suffice. This approach directly contradicts a low-cost monitoring goal and adds unnecessary noise that complicates troubleshooting.
When this WOULD be correct
If the question required detailed diagnostic data for troubleshooting application-level issues or security auditing, and cost was not a constraint, enabling verbose guest logging would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use Azure Monitor platform metrics for CPU instead of collecting guest logsCorrect answer▾
Why this is correct
Azure Monitor platform metrics for CPU are automatically collected for Azure VMs at no additional Log Analytics ingestion cost, and they are stored in the Azure metrics database which supports near-real-time alerting and charting. Guest-level logs require the Azure Monitor Agent, incurring per-GB ingestion fees and ongoing agent management. Because CPU percentage is a host-side metric, platform metrics provide exactly the data needed without sending any log data, making this the most cost-effective choice.
✗Collect all Windows event logs from every VMWrong answer — click to see why▾
Why this is wrong here
Collecting all Windows event logs from every VM generates excessive data, increasing ingestion costs and storage, which contradicts the goal of keeping costs low.
★ When this WOULD be the correct answer
If the question required comprehensive security auditing or compliance monitoring where all event logs must be retained for forensic analysis, and cost was not a constraint, then collecting all logs would be appropriate.
Why candidates choose this
Candidates may think that more data collection always leads to better monitoring, overlooking the cost implications and the fact that only relevant logs are needed for CPU monitoring.
✗Create a separate workspace for each VMWrong answer — click to see why▾
Why this is wrong here
Creating a separate workspace for each VM increases management overhead and costs, as each workspace incurs its own ingestion and retention charges, contradicting the goal of low costs.
★ When this WOULD be the correct answer
If the question required strict data isolation for compliance or security reasons (e.g., each VM belongs to a different client with separate data boundaries), then separate workspaces would be correct despite higher costs.
Why candidates choose this
Candidates may think separate workspaces help organize data and reduce cross-VM noise, but they overlook the cost implications and that Azure Monitor can filter data within a single workspace.
✗Enable verbose guest logging on every serverWrong answer — click to see why▾
Why this is wrong here
Verbose guest logging generates excessive data, increasing ingestion costs without providing additional value for CPU monitoring, which is already covered by platform metrics.
★ When this WOULD be the correct answer
If the question required detailed diagnostic data for troubleshooting application-level issues or security auditing, and cost was not a constraint, enabling verbose guest logging would be appropriate.
Why candidates choose this
Candidates may think more logging always provides better monitoring, overlooking the cost implications and the fact that platform metrics suffice for CPU monitoring.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.