AZ-104 Monitor and Maintain Azure Resources Practice Question
Your company needs to retain Azure Activity Log data longer than the built-in retention period and make it available for future analysis. What should you configure?
⚠ Common exam trap
It's easy for candidates to confuse the default retention period of the Activity Log with the ability to extend it, mistakenly thinking locks or other resource configurations can preserve log data, when only diagnostic settings enable long-term retention and export.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Diagnostic settings for the Activity Log
Azure Activity Log has a default retention period of 30 days for Standard tier subscriptions and 90 days for others. To retain data longer, you must configure diagnostic settings to stream the Activity Log to a Log Analytics workspace (for long-term querying) or to an Azure Storage account (for archival). Diagnostic settings allow you to define the retention duration beyond the built-in limit, enabling future analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Diagnostic settings for the Activity Log
Why this is correct
Diagnostic settings for the Activity Log are the correct mechanism because they stream the tenant's control-plane events to a Log Analytics workspace, storage account, or Event Hubs. This enables retention beyond the default 90-day portal window; for example, Log Analytics workspaces support up to two years of retention, and a storage account can hold the data indefinitely. The setting also allows export to tools for alerting and analysis, which is exactly what the requirement of retaining data longer demands.
- ✗
A CanNotDelete lock on the subscription
Why it's wrong here
A CanNotDelete lock on the subscription prevents administrators from accidentally deleting the subscription or its resources, but it has no effect on Azure's internal data retention policies. The Activity Log is stored by the platform for 90 days irrespective of any locks, and a lock neither extends that duration nor redirects the logs to durable storage. Lock management and log lifecycle management are entirely separate Azure Resource Manager controls.
When this WOULD be correct
When the question asks for a method to prevent accidental deletion of a critical Azure subscription or resource group, configuring a CanNotDelete lock would be the correct answer.
- ✗
An availability set
Why it's wrong here
An availability set is a compute-level construct that spreads virtual machines across fault domains and update domains to maintain high availability during hardware failures or planned maintenance. It does not capture, store, or influence any Azure platform logs, including the Activity Log. The existence or absence of availability sets has zero bearing on how long subscription-level activity data is retained.
When this WOULD be correct
When a question asks how to ensure high availability for virtual machines running a tiered application, such as web and database tiers, by distributing VMs across multiple fault and update domains.
- ✗
An NSG flow log only
Why it's wrong here
NSG flow logs are diagnostic data about IP traffic through network security groups, showing source/destination IPs, ports, and accepted/denied decisions, which is network-level rather than control-plane information. The Azure Activity Log records resource management events such as VM creation, configuration changes, and policy actions; flow logs do not contain those activity events. Additionally, flow logs have their own retention configuration and are entirely separate from the Activity Log's 90-day default storage window.
When this WOULD be correct
When the question asks how to analyze network traffic patterns or detect anomalies in IP flows through a virtual network, configuring an NSG flow log (often with a storage account or Log Analytics workspace) would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Diagnostic settings for the Activity LogCorrect answer▾
Why this is correct
Diagnostic settings for the Activity Log are the correct mechanism because they stream the tenant's control-plane events to a Log Analytics workspace, storage account, or Event Hubs. This enables retention beyond the default 90-day portal window; for example, Log Analytics workspaces support up to two years of retention, and a storage account can hold the data indefinitely. The setting also allows export to tools for alerting and analysis, which is exactly what the requirement of retaining data longer demands.
✗A CanNotDelete lock on the subscriptionWrong answer — click to see why▾
Why this is wrong here
A CanNotDelete lock prevents deletion of resources but does not extend the retention period of Activity Log data, which is the requirement in the question.
★ When this WOULD be the correct answer
When the question asks for a method to prevent accidental deletion of a critical Azure subscription or resource group, configuring a CanNotDelete lock would be the correct answer.
Why candidates choose this
Candidates may confuse 'retaining data' with 'protecting resources from deletion,' assuming a lock can preserve log data, but locks do not affect data retention policies.
✗An availability setWrong answer — click to see why▾
Why this is wrong here
An availability set is a logical grouping of VMs to ensure high availability, not a data retention or analysis tool. It cannot store or extend the retention of Activity Log data.
★ When this WOULD be the correct answer
When a question asks how to ensure high availability for virtual machines running a tiered application, such as web and database tiers, by distributing VMs across multiple fault and update domains.
Why candidates choose this
Candidates may confuse 'availability' with 'data availability' or mistakenly think that availability sets provide some form of logging or data storage capability.
✗An NSG flow log onlyWrong answer — click to see why▾
Why this is wrong here
NSG flow logs capture IP traffic through a network security group, not Azure Activity Log data. They are used for network monitoring and security analysis, not for extending retention of subscription-level operational logs.
★ When this WOULD be the correct answer
When the question asks how to analyze network traffic patterns or detect anomalies in IP flows through a virtual network, configuring an NSG flow log (often with a storage account or Log Analytics workspace) would be the correct answer.
Why candidates choose this
Candidates may confuse 'flow logs' with 'activity logs' due to similar terminology, or assume that any log-related configuration can extend retention of all log types.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Activity log
An activity log is a record of all operations performed on Azure resources, capturing who did what, when, and where, for auditing and troubleshooting purposes.
Key term
Log Analytics workspace
A Log Analytics workspace is a unique environment in Azure Monitor where log data from various sources is collected, stored, and queried for analysis and reporting.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.