AZ-104 Monitor and Maintain Azure Resources Practice Question
You are responsible for managing a large Azure environment with multiple subscriptions. You need to ensure compliance with company policies by auditing resource changes and enabling automated remediation for non-compliant resources. Which three of the following Azure services or features should you use? (Choose three.)
⚠ Common exam trap
Many exam-takers confuse Azure Policy with Azure Blueprints, thinking Blueprints provides ongoing auditing, when in fact Blueprints is only for initial deployment and does not monitor or remediate changes after deployment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy to define and enforce rules for resource configurations.
Azure Policy is correct because it allows you to define and enforce rules for resource configurations, ensuring compliance with company policies. The Activity Log is correct because it records all management operations, providing an audit trail for resource changes. Azure Automation with runbooks is correct because it can be triggered by Azure Policy or Activity Log alerts to automatically remediate non-compliant resources, such as stopping an unapproved VM or applying a required tag.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy to define and enforce rules for resource configurations.
Why this is correct
Azure Policy is the core governance service that lets you define and enforce rules on resource configurations, such as allowed locations, SKU sizes, and tagging requirements. It evaluates resources against these rules during creation, updating, and existing deployments, and can deny non-compliant actions, making it the primary mechanism to enforce standards. In this scenario, it directly addresses the need to maintain consistent configuration across a large environment.
- ✓
Azure Activity Log to record and review all management operations on resources.
Why this is correct
The Azure Activity Log is a subscription-level log that records all management operations on resources, including create, update, delete, and access control changes. It provides a complete audit trail for answering 'who did what and when', which is essential for reviewing and troubleshooting management operations. However, it is purely reactive and cannot enforce or prevent non-compliant resource configurations, so it supports governance but does not implement rules.
- ✓
Azure Automation with runbooks to automatically remediate non-compliant resources.
Why this is correct
Azure Automation with runbooks provides process automation capabilities that can automatically remediate non-compliant resources after they are detected. For example, a runbook can stop an undersized VM, apply required tags, or revert configuration drift, giving you a way to correct issues without manual intervention. This complements Azure Policy by addressing resources that may have slipped through enforcement or become non-compliant over time, but it is not the primary rule-definition tool.
- ✗
Azure Security Center (Defender for Cloud) to monitor for security threats.
Why it's wrong here
Azure Security Center (now Microsoft Defender for Cloud) is focused on security posture management and threat detection across workloads. It monitors for vulnerabilities, misconfigurations, and suspicious activity, and provides security recommendations, but it does not enforce general resource configuration rules like naming conventions or cost-related restrictions. Thus, while it enhances overall security, it is not the appropriate tool for defining and enforcing broad configuration compliance.
- ✗
Azure Resource Graph to query and visualize resource properties across subscriptions.
Why it's wrong here
Azure Resource Graph is a highly efficient query engine that lets you explore and visualize resource properties and relationships across all subscriptions in your environment. It enables fast discovery and analysis of resources—such as finding untagged or orphaned resources—but it is strictly read-only and cannot enforce or remediate configurations. This makes it a powerful audit and reporting aid, not a governance enforcement tool.
- ✗
Azure Blueprints to package and deploy environment definitions.
Why it's wrong here
Azure Blueprints is a deployment service that packages Azure resources, role assignments, policies, and templates into a self-contained environment definition for repeatable, orchestrated deployments. It can assign Azure Policies as part of a blueprint, but it operates at deployment time to set up an entire environment, not to continuously enforce configuration rules on existing resources. Therefore, while it supports governance through deployment, it is not the tool for ongoing enforcement and remediation.
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Activity log
An activity log is a record of all operations performed on Azure resources, capturing who did what, when, and where, for auditing and troubleshooting purposes.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.