AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  It improves visibility by collecting events from multiple devices in one place for review and investigation.

  Why this is correct

  Centralized logging aggregates syslog messages, Windows Event Logs, Azure Activity Logs, and resource diagnostic logs into a single Log Analytics workspace. This consolidation enables security and operations teams to search, correlate, and investigate events across all devices and workloads without jumping between multiple consoles. Because logs are stored in one queriable repository, incident response and root-cause analysis become significantly faster and more effective.

• ✗

  It guarantees that no unauthorized action can occur.

  Why it's wrong here

  Logging is fundamentally a detective control, not a preventive one; it records what happened after the fact and cannot stop an unauthorized action from occurring. Even with real-time alerting, there is a window during which the action has already taken place before detection and response can begin. Preventing unauthorized actions requires separate technical enforcements such as conditional access policies, RBAC, and resource locks.

  When this WOULD be correct

  In a different exam scenario, a question might ask about the benefits of implementing a comprehensive security framework. In that context, if the question emphasized the role of logging in enforcing security policies, option B could be seen as correct, suggesting that centralized logging contributes to preventing unauthorized actions through policy enforcement.

• ✗

  It replaces the need for NTP and authentication.

  Why it's wrong here

  Centralized logging depends on accurate, synchronized timestamps from NTP to correlate events correctly, and it depends on authentication and RBAC to control who can access the log data. Rather than replacing these controls, a robust logging solution reinforces them by providing an audit trail of administrative activity. Removing NTP or authentication would quickly degrade the reliability and security of the log collection itself.

  When this WOULD be correct

  In a question asking about the integration of various network services, one could argue that centralized logging systems can operate without NTP and authentication, focusing solely on log collection. In this context, if the question specified that centralized logging could function independently of these services, option C could be considered correct.

• ✗

  It automatically assigns IP addresses to monitoring systems.

  Why it's wrong here

  Dynamic IP address assignment is performed by DHCP (or static configuration), not by a logging system. Centralized logging only receives and stores event data; it has no mechanism for IP address management or network configuration. Even if log sources are discovered via network scanning, the logging platform does not assign addresses to the agents or devices sending data.

  When this WOULD be correct

  In a different exam scenario where the question asks about the functionalities of a network monitoring system that includes DHCP services, option D could be correct if the context is about how monitoring systems can manage IP address allocation for devices on a network.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”