AZ-104 Monitor and Maintain Azure Resources Practice Question
Your company must retain Azure Activity Log data beyond the built-in retention period and make it available for long-term analysis. Which configuration should you use?
⚠ Common exam trap
Watch out — candidates often confuse the built-in 90-day retention of the Activity Log with the ability to extend it, mistakenly thinking a lock or other resource configuration can preserve the data, when only diagnostic settings provide the export and retention control needed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Diagnostic settings for the Activity Log
Azure Activity Log is retained by default for 90 days. To store data beyond this period for long-term analysis, you must configure diagnostic settings to route the Activity Log to a Log Analytics workspace (for querying) or an Azure Storage account (for archival). This is the only native mechanism to extend retention and enable long-term analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Diagnostic settings for the Activity Log
Why this is correct
Diagnostic settings for the Activity Log are the correct mechanism because the Azure Activity Log has a default retention of 90 days, after which data is automatically purged unless you export it. By creating diagnostic settings, you can route Activity Log entries to a Log Analytics workspace, a storage account, or an Event Hubs namespace for long-term retention, alerting, or archival. This is the only configuration among the options that actually extends or preserves Activity Log data beyond the built-in retention period. Without such settings, the platform will discard older Activity Log records regardless of other actions.
- ✗
A ReadOnly lock on the subscription
Why it's wrong here
A ReadOnly lock on the subscription prevents users from deleting or modifying the subscription and its child resources, acting as a governance control to avoid accidental changes. However, locks operate at the Azure Resource Manager resource-management layer and do not affect the telemetry or platform logs generated within the subscription. The Activity Log retention period is a built-in platform default and is not influenced by resource locks, which only constrain management operations. To retain Activity Log data longer, you must explicitly configure diagnostic settings for export.
When this WOULD be correct
A ReadOnly lock would be correct if the question asked: 'You need to prevent accidental deletion or modification of a critical subscription resource. Which configuration should you use?'
- ✗
An availability set
Why it's wrong here
An availability set is a deployment configuration designed to keep virtual machines highly available by distributing them across fault and update domains, thereby protecting against hardware failures and maintenance downtime. It is purely an infrastructure deployment concept and has no role in storing, exporting, or retaining Azure platform logs. Configuring or removing an availability set has zero impact on the Activity Log's retention period, which is governed by the Azure platform log pipeline. This option is unrelated to the stated requirement and therefore incorrect.
When this WOULD be correct
This option would be correct in a question asking how to ensure high availability for virtual machines running in a single region, such as 'You need to deploy two VMs that must be placed on different fault domains and update domains. Which configuration should you use?'
- ✗
NSG flow logs only
Why it's wrong here
NSG flow logs capture information about IP traffic through Network Security Groups, such as source/destination IP, port, and whether the flow was allowed or denied. They only record data-plane network activity and have no relationship to the Azure Activity Log, which records control-plane events on the subscription such as resource creation or policy changes. Enabling NSG flow logs does not affect Activity Log retention in any way. These logs serve a completely different auditing purpose and cannot be substituted for Activity Log export.
When this WOULD be correct
When the question asks about analyzing network traffic patterns or detecting anomalies in IP flows through NSGs, and the requirement is to store flow logs for long-term analysis (e.g., using Log Analytics or storage accounts).
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Diagnostic settings for the Activity LogCorrect answer▾
Why this is correct
Diagnostic settings for the Activity Log are the correct mechanism because the Azure Activity Log has a default retention of 90 days, after which data is automatically purged unless you export it. By creating diagnostic settings, you can route Activity Log entries to a Log Analytics workspace, a storage account, or an Event Hubs namespace for long-term retention, alerting, or archival. This is the only configuration among the options that actually extends or preserves Activity Log data beyond the built-in retention period. Without such settings, the platform will discard older Activity Log records regardless of other actions.
✗A ReadOnly lock on the subscriptionWrong answer — click to see why▾
Why this is wrong here
A ReadOnly lock prevents modifications to resources but does not extend the retention period of Activity Log data beyond the default 90 days. Activity Log retention is managed via diagnostic settings, not locks.
★ When this WOULD be the correct answer
A ReadOnly lock would be correct if the question asked: 'You need to prevent accidental deletion or modification of a critical subscription resource. Which configuration should you use?'
Why candidates choose this
Candidates may confuse administrative controls (locks) with data retention mechanisms, thinking a lock preserves log data by preventing changes.
✗An availability setWrong answer — click to see why▾
Why this is wrong here
An availability set is a logical grouping of VMs to ensure high availability, not a configuration for retaining or analyzing Azure Activity Log data.
★ When this WOULD be the correct answer
This option would be correct in a question asking how to ensure high availability for virtual machines running in a single region, such as 'You need to deploy two VMs that must be placed on different fault domains and update domains. Which configuration should you use?'
Why candidates choose this
Candidates might confuse 'availability' with 'data availability' or think that availability sets provide some form of data retention or logging capability.
✗NSG flow logs onlyWrong answer — click to see why▾
Why this is wrong here
NSG flow logs capture IP traffic through a network security group, not Azure Activity Log data. They are used for network monitoring and security analysis, not for retaining subscription-level operational logs.
★ When this WOULD be the correct answer
When the question asks about analyzing network traffic patterns or detecting anomalies in IP flows through NSGs, and the requirement is to store flow logs for long-term analysis (e.g., using Log Analytics or storage accounts).
Why candidates choose this
Candidates may confuse 'logs' in general, thinking NSG flow logs can serve as a catch-all for logging needs, or they may not clearly distinguish between Activity Logs (control plane) and flow logs (data plane).
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your company must retain Azure Activity Log data beyond the default retention period and make it available for long-term analysis. What should you configure?
hard- ✓ A.Diagnostic settings for the Activity Log
- B.A ReadOnly lock on the subscription
- C.An availability set
- D.NSG flow logs only
Why A: Diagnostic settings for the Activity Log allow you to stream the log to a Log Analytics workspace, storage account, or Event Hubs, thereby extending retention beyond the default 90 days (for storage) or indefinitely (in Log Analytics). This is the only mechanism that enables long-term retention and analysis of Azure Activity Log data.
Variation 2. Your company needs to retain Azure Activity Log data longer than the built-in retention period and make it available for future analysis. What should you configure?
hard- ✓ A.Diagnostic settings for the Activity Log
- B.A CanNotDelete lock on the subscription
- C.An availability set
- D.An NSG flow log only
Why A: Azure Activity Log has a default retention period of 30 days for Standard tier subscriptions and 90 days for others. To retain data longer, you must configure diagnostic settings to stream the Activity Log to a Log Analytics workspace (for long-term querying) or to an Azure Storage account (for archival). Diagnostic settings allow you to define the retention duration beyond the built-in limit, enabling future analysis.
Variation 3. You need to keep Azure activity log data for longer than the default retention period and make it available for analysis. What should you configure?
hard- ✓ A.Diagnostic settings for the activity log
- B.A resource lock on the subscription
- C.An availability zone
- D.A scale set autoscale policy
Why A: The default retention period for Azure activity logs is 90 days. To retain activity log data beyond this period and make it available for analysis (e.g., in a Log Analytics workspace, storage account, or Event Hubs), you must configure diagnostic settings for the activity log. This allows you to stream the log data to a destination of your choice, where you can set custom retention policies.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.