AZ-104 Monitor and Maintain Azure Resources Practice Question
Your operations team needs to run Kusto queries across collected sign-in logs, VM performance counters, and Azure Activity Log data in a central location. What should you deploy?
⚠ Common exam trap
Many exam-takers confuse a Log Analytics workspace with other networking or compute resources, thinking a NAT gateway or public IP is needed for data ingestion, when in fact Azure Monitor agents and diagnostic settings send data directly to the workspace without requiring public internet exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Log Analytics workspace
A Log Analytics workspace is the central repository in Azure that ingests and stores diagnostic data from multiple sources, including sign-in logs (Azure AD), VM performance counters (Azure Monitor for VMs), and Azure Activity Logs. It supports Kusto Query Language (KQL) for running complex queries across all collected data, making it the correct choice for this requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A Log Analytics workspace
Why this is correct
A Log Analytics workspace is the Azure Monitor service designed specifically for centralized log retention, indexing, and KQL-based analysis. It ingests telemetry from Azure resources, operating systems, and applications, then stores that data in queryable tables. Running Kusto queries across collected logs requires this workspace as the analytical backend, making it the only valid choice here.
- ✗
An availability zone
Why it's wrong here
An availability zone is a set of physically isolated datacenters within an Azure region that protect applications from datacenter failures. It is an infrastructure resiliency feature, providing high availability for resources, but it has no ability to collect, store, or query operational logs. Therefore, availability zones cannot serve as a substrate for Kusto queries, which require a dedicated log analytics data store.
When this WOULD be correct
You need to deploy a solution that ensures your application remains available even if one Azure datacenter fails. Deploying VMs across multiple availability zones provides fault tolerance and high availability.
- ✗
A NAT gateway
Why it's wrong here
A NAT gateway is a fully managed networking service that enables outbound internet connectivity for subnets in a virtual network by performing source network address translation. Its functionality ends at IP address translation and routing; it does not retain telemetry logs or expose any querying interface. While NAT gateways can emit diagnostic metrics and logs to a Log Analytics workspace, they are not themselves a platform for running Kusto queries.
When this WOULD be correct
You need to provide secure outbound internet access for resources in a virtual network while preventing inbound connections from the internet. Deploying a NAT gateway would be the correct solution.
- ✗
A standard public IP address
Why it's wrong here
A standard public IP address is a standalone resource that assigns a public IPv4 or IPv6 address to an Azure VM, load balancer, or gateway for internet communication. It is purely an address allocation object, with no data plane for storing operational logs or a query engine to process Kusto queries. Diagnostic settings from resources using the IP can be streamed elsewhere, but the IP resource itself cannot be queried directly.
When this WOULD be correct
When a question asks for a resource that provides a static public IPv4 address for outbound internet access from a virtual machine or load balancer, or for inbound access to a resource without a public endpoint, a standard public IP address is the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Log Analytics workspaceCorrect answer▾
Why this is correct
A Log Analytics workspace is the Azure Monitor service designed specifically for centralized log retention, indexing, and KQL-based analysis. It ingests telemetry from Azure resources, operating systems, and applications, then stores that data in queryable tables. Running Kusto queries across collected logs requires this workspace as the analytical backend, making it the only valid choice here.
✗An availability zoneWrong answer — click to see why▾
Why this is wrong here
An availability zone is a physically separate datacenter within an Azure region, used for high availability and disaster recovery, not for centralizing and querying log data from multiple sources.
★ When this WOULD be the correct answer
You need to deploy a solution that ensures your application remains available even if one Azure datacenter fails. Deploying VMs across multiple availability zones provides fault tolerance and high availability.
Why candidates choose this
Candidates may confuse 'availability zone' with a centralized data repository, or think it provides a central location for data, but it is actually a high-availability feature.
✗A NAT gatewayWrong answer — click to see why▾
Why this is wrong here
A NAT gateway is used to enable outbound internet connectivity for virtual networks, not to centralize and query logs. It does not store or analyze log data.
★ When this WOULD be the correct answer
You need to provide secure outbound internet access for resources in a virtual network while preventing inbound connections from the internet. Deploying a NAT gateway would be the correct solution.
Why candidates choose this
Candidates may confuse 'gateway' with a central collection point, or think NAT is involved in log routing due to its role in network traffic.
✗A standard public IP addressWrong answer — click to see why▾
Why this is wrong here
A standard public IP address is used for outbound connectivity and inbound access to Azure resources, not for centralizing and querying log data from multiple sources like sign-in logs, VM performance counters, and Activity Logs.
★ When this WOULD be the correct answer
When a question asks for a resource that provides a static public IPv4 address for outbound internet access from a virtual machine or load balancer, or for inbound access to a resource without a public endpoint, a standard public IP address is the correct answer.
Why candidates choose this
Candidates may confuse public IP addresses with the concept of a 'central location' for data, thinking that a public IP could be used to aggregate logs from different sources via network endpoints.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Monitor
Azure Monitor is a cloud service that collects, analyzes, and acts on telemetry data from your Azure and on-premises resources to help you understand performance and availability.
Key term
Kusto Query Language
Kusto Query Language (KQL) is a read-only, high-performance query language used to analyze large datasets, especially for log monitoring, security investigations, and operational analytics in Microsoft Azure.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.