AZ-104 Monitor and Maintain Azure Resources Practice Question
You want to send a storage account's platform logs to a workspace so they can be queried with KQL later. Which two items are part of the required configuration? Select two.
⚠ Common exam trap
Test-takers frequently confuse the destination (Log Analytics workspace) with the source configuration (diagnostic settings), or mistakenly think that network-level components like NSGs or redundancy features like availability zones are involved in log routing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Diagnostic settings on the storage account
A is correct because diagnostic settings on the storage account are the mechanism that defines which platform logs (e.g., storage read/write/delete operations) are collected and where they are sent. Without configuring diagnostic settings, the storage account does not emit logs to any destination. B is correct because a Log Analytics workspace is the required destination for storing the logs so they can be queried with KQL; it provides the ingestion and retention infrastructure for log analytics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Diagnostic settings on the storage account
Why this is correct
A diagnostic setting acts as the export rule configured directly on the storage account resource. It specifies which platform log categories (such as StorageRead, StorageWrite, and StorageDelete) and which metrics are streamed to a selected destination, like a Log Analytics workspace. Without this setting, the workspace never receives the storage account's telemetry, even if the workspace exists and is healthy.
- ✓
A Log Analytics workspace
Why this is correct
The Log Analytics workspace is the ingestion and storage destination that receives the diagnostic logs sent from the storage account. It organizes the incoming data into table types such as StorageBlobLogs and StorageFileLogs, and it enables querying, alerting, and retention management using Kusto Query Language (KQL). The workspace itself does not trigger or control log export; it passively stores whatever the diagnostic setting delivers.
- ✗
A network security group
Why it's wrong here
A network security group (NSG) applies security rules that allow or deny traffic at subnet or network interface boundaries, focusing purely on network-level filtering. It does not generate, collect, or route platform-level logs from Azure Storage, which include operation and transaction details. Although NSG flow logs can be sent to a Log Analytics workspace, those logs represent network traffic events, not storage account diagnostic data.
When this WOULD be correct
When the question asks: 'You need to enable logging of network traffic flows to a storage account for later analysis. Which Azure resource should you configure to capture the traffic logs?' In that case, an NSG with flow logs enabled would be the correct answer.
- ✗
A Recovery Services vault
Why it's wrong here
A Recovery Services vault is designed for backup and disaster recovery workloads, storing backup copies and replication data for protected Azure resources. It provides a protected container for recovery points, but it does not function as a log analytics destination, a throughput for telemetry, or a filter for operational data. Storage account platform logs are never routed to a Recovery Services vault under any diagnostic setting.
When this WOULD be correct
When the question asks: 'You need to configure backup for Azure virtual machines. Which Azure resource should you create to store backup data?' In that case, a Recovery Services vault is the correct answer.
- ✗
An availability zone assignment
Why it's wrong here
An availability zone assignment determines which physical datacenter in a region hosts the storage account for resilience against datacenter-level failures, part of the redundancy configuration. This zone placement affects durability and availability of the resource, but it has no interaction with telemetry export or log collection. No zone setting can instruct the storage account to send platform logs to a workspace.
When this WOULD be correct
In a question about ensuring high availability for a storage account, you might need to select an availability zone assignment as part of the configuration to protect against datacenter failures.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Diagnostic settings on the storage accountCorrect answer▾
Why this is correct
A diagnostic setting acts as the export rule configured directly on the storage account resource. It specifies which platform log categories (such as StorageRead, StorageWrite, and StorageDelete) and which metrics are streamed to a selected destination, like a Log Analytics workspace. Without this setting, the workspace never receives the storage account's telemetry, even if the workspace exists and is healthy.
✗A network security groupWrong answer — click to see why▾
Why this is wrong here
A network security group (NSG) filters network traffic to/from Azure resources, but it does not collect or route platform logs to a Log Analytics workspace. Diagnostic settings on the resource (like the storage account) are required to send logs to the workspace.
★ When this WOULD be the correct answer
When the question asks: 'You need to enable logging of network traffic flows to a storage account for later analysis. Which Azure resource should you configure to capture the traffic logs?' In that case, an NSG with flow logs enabled would be the correct answer.
Why candidates choose this
Candidates may confuse network security groups with log collection because NSGs can generate diagnostic logs (like flow logs), but those logs are not sent to a workspace via the NSG itself—they require a separate diagnostic setting.
✗A Recovery Services vaultWrong answer — click to see why▾
Why this is wrong here
A Recovery Services vault is used for backup and disaster recovery (Azure Backup, Site Recovery), not for collecting platform logs to a Log Analytics workspace. Diagnostic settings and a Log Analytics workspace are the required components.
★ When this WOULD be the correct answer
When the question asks: 'You need to configure backup for Azure virtual machines. Which Azure resource should you create to store backup data?' In that case, a Recovery Services vault is the correct answer.
Why candidates choose this
Candidates may confuse Recovery Services vault with Log Analytics workspace, thinking both are 'storage' for logs, or they may associate 'vault' with secure log storage.
✗An availability zone assignmentWrong answer — click to see why▾
Why this is wrong here
Availability zone assignment is a high-availability feature for Azure resources, not a component for collecting platform logs into a Log Analytics workspace. Diagnostic settings and a Log Analytics workspace are the required items.
★ When this WOULD be the correct answer
In a question about ensuring high availability for a storage account, you might need to select an availability zone assignment as part of the configuration to protect against datacenter failures.
Why candidates choose this
Candidates may confuse availability zones with the need for redundancy in log collection, or they might think that distributing resources across zones is necessary for logging.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
Log Analytics workspace
A Log Analytics workspace is a unique environment in Azure Monitor where log data from various sources is collected, stored, and queried for analysis and reporting.
Key term
KQL
Kusto Query Language is a powerful read-only query language used to explore, analyze, and visualize large datasets, most notably in Azure Data Explorer and Microsoft Sentinel.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.