AZ-104 Monitor and Maintain Azure Resources Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Diagnostic settings for the storage account

  Why this is correct

  Diagnostic settings for a storage account are the Azure configuration that exports data-plane logs—including individual read, write, and delete operations—to a Log Analytics workspace, Event Hub, or archival storage. These settings define which log categories to stream (for example, StorageRead, StorageWrite, StorageDelete) and let you build audit queries against the collected events. Unlike monitoring signals, this is the actual mechanism that continuously delivers the operational event stream for analysis.

• ✗

  An action group

  Why it's wrong here

  An action group is a reusable set of notification channels—email, SMS, push, webhook, ITSM, or automation runbook—that gets invoked after an alert rule fires. It does not collect, transform, or route logs; it merely sends a response to a signal that already exists. Using an action group without a diagnostic setting would mean that storage read/write/delete events are never gathered, so there is nothing to act on.

  When this WOULD be correct

  You need to configure email/SMS/push notifications for administrators when a specific metric threshold is breached (e.g., when storage account latency exceeds 5 seconds).

• ✗

  A metric alert rule

  Why it's wrong here

  A metric alert rule watches numeric performance counters such as Egress, Ingress, or Availability and triggers when a threshold or dynamic condition is met. It neither ingests individual storage operations nor forwards them to Log Analytics; it only produces a notification when an aggregate value breaches the rule. Because it discards per-request details like the exact object path, user, and action, it cannot serve as a log export path for read/write/delete events.

  When this WOULD be correct

  You need to be notified when the number of storage account transactions exceeds a certain threshold (e.g., 1000 transactions per minute) to detect potential throttling or unusual activity.

• ✗

  A Recovery Services vault

  Why it's wrong here

  A Recovery Services vault is a backup and disaster-recovery container that holds recovery points and backup policies for Azure VMs, SQL databases, and Azure Files, and it manages backup-specific alerts and reports. It has no role in ingesting or exporting a storage account’s operational audit logs, as those logs are platform-level resource logs that fall outside the backup service’s scope. Moreover, the vault itself only records its own backup job activity, not data-plane operations on customer storage accounts.

  When this WOULD be correct

  When the question asks how to protect Azure VMs or files by enabling backup, or how to replicate on-premises workloads to Azure for disaster recovery, configuring a Recovery Services vault is the correct answer.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question