AZ-104 Monitor and Maintain Azure Resources Practice Question
Your company wants to query performance and event data from multiple Azure virtual machines by using Kusto Query Language. The operations team also wants to centralize retention and analysis of this data. What should you deploy?
⚠ Common exam trap
Many exam-takers confuse Azure Advisor or Network Watcher as monitoring tools, but neither provides the centralized log storage and KQL querying required for VM performance and event data analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Log Analytics workspace.
A Log Analytics workspace is the correct choice because it is the central repository in Azure Monitor for collecting telemetry and log data from Azure virtual machines. It supports Kusto Query Language (KQL) for querying performance and event data, and it provides centralized retention, analysis, and alerting capabilities, meeting both requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A Log Analytics workspace.
Why this is correct
A Log Analytics workspace is the correct destination for querying performance and event data because it acts as Azure Monitor's central repository for log data. It ingests activity logs, resource diagnostics, and VM guest metrics, retaining them for customizable retention periods and enabling rich KQL (Kusto Query Language) queries across all collected signals for troubleshooting and analysis.
- ✗
Azure Advisor.
Why it's wrong here
Azure Advisor is a personalized recommendation engine that analyzes resource configurations and usage to suggest best practices for cost, security, reliability, and performance. It does not ingest raw telemetry, store logs, or provide a KQL query environment, so it is in no way a log analytics platform for querying performance and event data.
When this WOULD be correct
An exam question asking: 'Which Azure service provides recommendations to improve the reliability, security, and performance of your Azure resources?' would have Azure Advisor as the correct answer.
- ✗
Azure Network Watcher only.
Why it's wrong here
Azure Network Watcher is a network-specific diagnostic tool, not a general log analytics platform. While it provides packet captures, connection monitors, and NSG flow logs, it cannot aggregate OS-level performance counters, application event logs, or other guest telemetry, nor does it offer a KQL-based query interface for cross-resource log analysis.
When this WOULD be correct
If the question asked for a tool to monitor network traffic, diagnose connectivity issues, or capture network packets across Azure VMs, Azure Network Watcher would be the correct answer.
- ✗
A network security group.
Why it's wrong here
A network security group (NSG) is a filtering mechanism that controls allowed or denied traffic at the subnet or NIC level. Although NSG flow logs can be sent to a Log Analytics workspace, the NSG itself does not store or query performance and event data—it simply evaluates traffic rules and has no built-in logging or analytics capability for VM guest metrics.
When this WOULD be correct
You need to restrict inbound and outbound network traffic to a subnet or network interface in Azure. Deploying a network security group and associating it with the subnet or NIC would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Log Analytics workspace.Correct answer▾
Why this is correct
A Log Analytics workspace is the correct destination for querying performance and event data because it acts as Azure Monitor's central repository for log data. It ingests activity logs, resource diagnostics, and VM guest metrics, retaining them for customizable retention periods and enabling rich KQL (Kusto Query Language) queries across all collected signals for troubleshooting and analysis.
✗Azure Advisor.Wrong answer — click to see why▾
Why this is wrong here
Azure Advisor provides personalized recommendations for best practices in Azure, but it does not collect, store, or allow querying of performance and event data from VMs using KQL.
★ When this WOULD be the correct answer
An exam question asking: 'Which Azure service provides recommendations to improve the reliability, security, and performance of your Azure resources?' would have Azure Advisor as the correct answer.
Why candidates choose this
Candidates may confuse Advisor's monitoring and recommendation capabilities with the data collection and analysis features of Log Analytics, assuming Advisor can also query performance data.
✗Azure Network Watcher only.Wrong answer — click to see why▾
Why this is wrong here
Azure Network Watcher provides network monitoring and diagnostics, but it does not centralize querying of performance and event data from multiple VMs using Kusto Query Language; that requires a Log Analytics workspace.
★ When this WOULD be the correct answer
If the question asked for a tool to monitor network traffic, diagnose connectivity issues, or capture network packets across Azure VMs, Azure Network Watcher would be the correct answer.
Why candidates choose this
Candidates may confuse Network Watcher's monitoring capabilities with the broader data analysis and querying features of Log Analytics, assuming network monitoring includes performance and event data analysis.
✗A network security group.Wrong answer — click to see why▾
Why this is wrong here
A network security group (NSG) filters network traffic to and from Azure resources; it does not collect, retain, or analyze performance and event data using Kusto Query Language.
★ When this WOULD be the correct answer
You need to restrict inbound and outbound network traffic to a subnet or network interface in Azure. Deploying a network security group and associating it with the subnet or NIC would be the correct answer.
Why candidates choose this
Candidates may confuse NSG flow logs (which can be sent to Log Analytics) with the NSG itself, or mistakenly think NSGs provide centralized data analysis capabilities.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Log Analytics workspace
A Log Analytics workspace is a unique environment in Azure Monitor where log data from various sources is collected, stored, and queried for analysis and reporting.
Key term
Kusto Query Language
Kusto Query Language (KQL) is a read-only, high-performance query language used to analyze large datasets, especially for log monitoring, security investigations, and operational analytics in Microsoft Azure.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.