AZ-104 Monitor and Maintain Azure Resources Practice Question
An administrator wants to send a virtual machine's guest logs to a central workspace so they can search them later with queries. Which configuration should be created on the VM or its resource provider first?
⚠ Common exam trap
Candidates often confuse a diagnostic setting with a role assignment, thinking that granting permissions (RBAC) is the first step to enable log collection, but in reality, the diagnostic setting is the specific configuration that defines what logs to send and where.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A diagnostic setting
A diagnostic setting is the correct configuration because it enables the streaming of guest OS logs (e.g., System, Application, Security event logs) from an Azure virtual machine to a Log Analytics workspace. This is done by installing the Azure Monitor Agent (AMA) or legacy Log Analytics agent on the VM and then configuring a data collection rule or diagnostic setting to specify which logs to send and the destination workspace. Without this setting, the VM's guest logs remain local and cannot be queried centrally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A role assignment at the subscription scope
Why it's wrong here
A role assignment at the subscription scope controls access permissions through Azure RBAC, determining who can read, write, or manage resources within the subscription. It has no data-plane capability to capture, route, or export telemetry from a VM to a Log Analytics workspace—that is a functional role of diagnostic settings and agents. Even assigning the Log Analytics Contributor role enables managing workspace resources, but it does not by itself cause any log data to flow from a VM into the workspace.
When this WOULD be correct
If the question were about granting a managed identity or service principal the necessary permissions (e.g., 'Log Analytics Contributor') to write diagnostic data to a workspace, then a role assignment at the subscription scope would be the correct first step before configuring diagnostic settings.
- ✓
A diagnostic setting
Why this is correct
A diagnostic setting is the correct mechanism because it explicitly defines which logs and metrics from a virtual machine are streamed to an Azure Monitor destination such as a Log Analytics workspace. For guest OS logs (like Windows Event logs or Syslog), you must combine the diagnostic setting with an installed monitoring agent—either the legacy Log Analytics agent or the newer Azure Monitor Agent—to actually collect and forward those events. Without this, platform-level logs may be available, but guest-level log collection would not occur.
- ✗
A private endpoint
Why it's wrong here
A private endpoint is a network construct that assigns a private IP address to an Azure service from your virtual network, enabling private connectivity to that service. In the context of a Log Analytics workspace, a private endpoint would affect how the VM reaches the workspace's ingestion endpoint, but it does not initiate or perform log collection on its own. Without a diagnostic setting and a properly configured agent, the VM guest logs will not be sent to a workspace regardless of network connectivity.
When this WOULD be correct
A private endpoint would be correct if the question were: 'An administrator needs to ensure that a virtual machine connects to a Log Analytics workspace over a private network, avoiding the public internet.' In that case, creating a private endpoint on the workspace would be the first step.
- ✗
A lock on the VM resource group
Why it's wrong here
A lock placed on the VM resource group (or the VM itself) provides a safeguard against accidental deletion or modification by enforcing a 'CanNotDelete' or 'ReadOnly' state. It is a governance and protection tool that prevents administrative changes, but it has zero involvement in log collection, telemetry streaming, or workspace integration. Locks operate on the management plane of Azure and do not influence the data plane or guest OS activity.
When this WOULD be correct
A question asks: 'An administrator wants to prevent accidental deletion of a virtual machine and its associated resources. Which configuration should be applied?' In that case, a lock on the resource group would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A diagnostic settingCorrect answer▾
Why this is correct
A diagnostic setting is the correct mechanism because it explicitly defines which logs and metrics from a virtual machine are streamed to an Azure Monitor destination such as a Log Analytics workspace. For guest OS logs (like Windows Event logs or Syslog), you must combine the diagnostic setting with an installed monitoring agent—either the legacy Log Analytics agent or the newer Azure Monitor Agent—to actually collect and forward those events. Without this, platform-level logs may be available, but guest-level log collection would not occur.
✗A role assignment at the subscription scopeWrong answer — click to see why▾
Why this is wrong here
A role assignment at the subscription scope grants permissions to users or services but does not configure data collection or forwarding of VM guest logs to a Log Analytics workspace. Diagnostic settings are required to specify which logs and metrics to send and where to send them.
★ When this WOULD be the correct answer
If the question were about granting a managed identity or service principal the necessary permissions (e.g., 'Log Analytics Contributor') to write diagnostic data to a workspace, then a role assignment at the subscription scope would be the correct first step before configuring diagnostic settings.
Why candidates choose this
Candidates may confuse the need for permissions (role assignment) with the actual configuration of data collection, assuming that assigning a role is a prerequisite for any logging setup, when in fact diagnostic settings handle both the configuration and can leverage system-assigned identities without explicit role assignments.
✗A private endpointWrong answer — click to see why▾
Why this is wrong here
A private endpoint is used to securely connect to a service over a private IP address, not to send guest logs to a Log Analytics workspace. The question asks for sending logs, which requires a diagnostic setting, not network connectivity.
★ When this WOULD be the correct answer
A private endpoint would be correct if the question were: 'An administrator needs to ensure that a virtual machine connects to a Log Analytics workspace over a private network, avoiding the public internet.' In that case, creating a private endpoint on the workspace would be the first step.
Why candidates choose this
Candidates may confuse private endpoints with diagnostic settings because both involve connecting to Azure services. They might think that a private endpoint is needed for secure log transmission, but diagnostic settings handle log routing without requiring private endpoints.
✗A lock on the VM resource groupWrong answer — click to see why▾
Why this is wrong here
A lock on the VM resource group prevents deletion or modification of resources, but it does not enable sending guest logs to a central workspace. Diagnostic settings are required to route logs.
★ When this WOULD be the correct answer
A question asks: 'An administrator wants to prevent accidental deletion of a virtual machine and its associated resources. Which configuration should be applied?' In that case, a lock on the resource group would be correct.
Why candidates choose this
Candidates may confuse resource locks with access controls or think that locking the resource group is a prerequisite for configuring log collection, but locks do not affect data routing.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Diagnostic setting
A Diagnostic setting is a configuration in Azure that controls where and how resource logs and metrics are collected, stored, and streamed for monitoring and analysis.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.