AZ-104 Monitor and Maintain Azure Resources Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Diagnostic settings

  Why this is correct

  Diagnostic settings are the Azure-native mechanism that directs Azure Firewall logs, such as the application, network, and DNS proxy rule logs, to a monitoring destination like a Log Analytics workspace, storage account, or Event Hub. By enabling diagnostic settings, you can set custom retention periods for log retention and use KQL queries for long-term analysis. Without this, the firewall only retains logs for the fixed, brief period defined by the service itself.

• ✗

  A resource lock

  Why it's wrong here

  A resource lock is an Azure management control that prevents accidental deletion or modification of a critical subscription, resource group, or resource by setting a CanNotDelete or ReadOnly scope. This lock enforces governance and audit policy but never interacts with telemetry or log pipelines. While it might protect the firewall's configuration, it does not affect where the firewall's logs are sent or how they are retained for long-term analysis.

  When this WOULD be correct

  A resource lock would be correct if the question asked: 'You need to prevent accidental deletion of an Azure Firewall configuration. What should you configure?'

• ✗

  An availability set

  Why it's wrong here

  An availability set is an Azure construct that groups virtual machines into fault domains and update domains to guarantee that a subset of VMs remains online during planned maintenance or hardware failures. It is purely a resiliency feature for VM placement and has no responsibility for capturing, exporting, or analyzing log data. In the context of Azure Firewall, it is irrelevant and cannot perform any retention or export role.

  When this WOULD be correct

  When a question asks how to ensure high availability for a set of virtual machines running a critical application, configuring an availability set would be the correct answer to protect against hardware failures and planned maintenance.

• ✗

  A VNet peering connection

  Why it's wrong here

  VNet peering is a networking feature that connects two Azure virtual networks, enabling traffic to route between them with low latency over Microsoft's backbone. It is used exclusively for network connectivity and routing, not for data collection or monitoring. Peering has no bearing on Azure Firewall logs, and enabling or removing peering will not produce or store any log analytics data.

  When this WOULD be correct

  You need to enable communication between two virtual networks that are in different regions or subscriptions, and you want to route traffic through Azure Firewall. VNet peering would be configured to connect the networks, with the firewall as a central inspection point.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question