AZ-104 Monitor and Maintain Azure Resources Practice Question
Which two statements about a Log Analytics workspace are correct? Select two.
⚠ Common exam trap
Test-takers frequently confuse the monitoring and log storage capabilities of Log Analytics workspaces with other Azure services like Azure Backup, Azure Policy, or RBAC, leading them to select options that describe those separate services instead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It can store logs collected from Azure resources
A Log Analytics workspace is a centralized repository that can ingest and store log data from various Azure resources, including virtual machines, Azure Activity logs, and resource diagnostics, enabling monitoring and analysis. Option B is correct because Log Analytics workspaces support Kusto Query Language (KQL) queries, which allow users to perform complex searches, aggregations, and visualizations on the stored log data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It can store logs collected from Azure resources
Why this is correct
A Log Analytics workspace is the central repository in Azure Monitor for telemetry and diagnostic data collected from Azure resources such as virtual machines, App Services, and Azure Active Directory. Data enters via diagnostic settings, agents, and other connectors, and is stored in structured tables that can be retained based on your retention policies for analysis and troubleshooting.
- ✓
It supports KQL queries
Why this is correct
The Log Analytics workspace provides a powerful query interface that uses Kusto Query Language (KQL) to search, filter, aggregate, and join data from its tables. Analysts can create complex queries with time-series functions and advanced operators, enabling custom dashboards, alert rules, and ad-hoc root-cause analysis across the collected logs.
- ✗
It creates backups of Azure virtual machines
Why it's wrong here
Creating backups of Azure virtual machines is exclusively handled by Azure Backup, which stores recovery points in a Recovery Services vault and manages backup schedules and retention. While a Log Analytics workspace can ingest backup health and report data from Azure Backup for centralized monitoring, it does not perform any backup operations itself.
When this WOULD be correct
This option would be correct in a question about Azure Backup or Azure Site Recovery, where the service's primary function is to create and manage backups of Azure virtual machines.
- ✗
It assigns permissions to Azure resources at scope
Why it's wrong here
Assigning permissions to Azure resources is a function of Azure Role-Based Access Control (RBAC), which uses role assignments to grant principals access at a specific scope like a management group, subscription, or resource group. Log Analytics workspaces have their own access modes to control who can query the workspace data, but the workspace does not assign permissions to other Azure resources; that happens in the management plane via RBAC.
When this WOULD be correct
This option would be correct if the question were about Azure RBAC or Azure Policy. For example: 'Which tool allows you to assign permissions to Azure resources at a specific scope?' — then Azure RBAC role assignments would be the correct answer.
- ✗
It blocks resource creation that violates a rule
Why it's wrong here
Blocking the creation of resources that violate compliance rules is a feature of Azure Policy, which uses policy definitions and initiatives to evaluate and deny noncompliant deployments at scope. A Log Analytics workspace is a passive data store and does not participate in the deployment or authorization pipeline, so it cannot intercept or prevent resource creation; it only receives diagnostic data after resources exist.
When this WOULD be correct
This option would be correct if the question asked about Azure Policy, which can block resource creation that violates a rule. For example, 'Which Azure service can prevent deployment of resources that do not meet compliance rules?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓It can store logs collected from Azure resourcesCorrect answer▾
Why this is correct
A Log Analytics workspace is the central repository in Azure Monitor for telemetry and diagnostic data collected from Azure resources such as virtual machines, App Services, and Azure Active Directory. Data enters via diagnostic settings, agents, and other connectors, and is stored in structured tables that can be retained based on your retention policies for analysis and troubleshooting.
✗It creates backups of Azure virtual machinesWrong answer — click to see why▾
Why this is wrong here
A Log Analytics workspace is for collecting and analyzing log data, not for creating backups of Azure virtual machines. Backup functionality is provided by Azure Backup, not Log Analytics.
★ When this WOULD be the correct answer
This option would be correct in a question about Azure Backup or Azure Site Recovery, where the service's primary function is to create and manage backups of Azure virtual machines.
Why candidates choose this
Candidates may confuse Log Analytics with Azure Backup because both are management services, or they might think that storing logs implies backup capabilities.
✗It assigns permissions to Azure resources at scopeWrong answer — click to see why▾
Why this is wrong here
Log Analytics workspace is a monitoring and log management service, not an identity and access management tool. It does not assign permissions to Azure resources at any scope; that is the role of Azure RBAC (Role-Based Access Control) applied to management groups, subscriptions, resource groups, or individual resources.
★ When this WOULD be the correct answer
This option would be correct if the question were about Azure RBAC or Azure Policy. For example: 'Which tool allows you to assign permissions to Azure resources at a specific scope?' — then Azure RBAC role assignments would be the correct answer.
Why candidates choose this
Candidates may confuse the concept of 'workspace' with a management scope, or think that Log Analytics workspaces can control access to resources because they are often used in conjunction with Azure Policy or RBAC for monitoring purposes.
✗It blocks resource creation that violates a ruleWrong answer — click to see why▾
Why this is wrong here
A Log Analytics workspace is used for collecting and querying log data, not for blocking resource creation. Azure Policy, not Log Analytics, enforces rules to block non-compliant resource creation.
★ When this WOULD be the correct answer
This option would be correct if the question asked about Azure Policy, which can block resource creation that violates a rule. For example, 'Which Azure service can prevent deployment of resources that do not meet compliance rules?'
Why candidates choose this
Candidates may confuse Log Analytics with Azure Policy because both are used in monitoring and governance scenarios, and the idea of 'blocking' aligns with security controls, but Log Analytics does not enforce policies.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Kusto Query Language
Kusto Query Language (KQL) is a read-only, high-performance query language used to analyze large datasets, especially for log monitoring, security investigations, and operational analytics in Microsoft Azure.
Key term
KQL
Kusto Query Language is a powerful read-only query language used to explore, analyze, and visualize large datasets, most notably in Azure Data Explorer and Microsoft Sentinel.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.