Question 580 of 1,049
AZ-104 Monitor and Maintain Azure Resources Practice Question
Your operations team wants to query collected VM log data by using Kusto Query Language and retain it centrally for analysis. Which Azure resource should you deploy?
⚠ Common exam trap
The trap here is that candidates might confuse a Log Analytics workspace with a simple storage account or think that local accounts or NSGs can somehow be used for log aggregation, but only a Log Analytics workspace provides the KQL query engine and central retention required for this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Log Analytics workspace
A Log Analytics workspace is the correct Azure resource because it serves as the central repository for VM log data collected via Azure Monitor agents. It supports Kusto Query Language (KQL) for querying and analyzing the collected data, enabling the operations team to perform advanced log analytics and retention. This aligns directly with the requirement to query and retain VM log data centrally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A Log Analytics workspace
Why this is correct
A Log Analytics workspace is the central data repository and query platform for Azure Monitor Logs. Each workspace provides a unique log namespace where agents (such as Azure Monitor Agent or the legacy Log Analytics agent) and diagnostic settings deliver VM logs, performance counters, and events. You can then run KQL (Kusto Query Language) queries across all collected logs, create alerts, and build workbooks without having to access individual VMs.
- ✗
An availability set
Why it's wrong here
An availability set is a VM resiliency grouping that distributes instances across fault domains and update domains to minimize downtime during hardware failures or planned maintenance. It only provides placement and high-availability guarantees for IaaS VMs, not a logging pipeline or a data store. Since it contains no instruments to collect, retain, or query log data, it cannot be used to query VM log data.
When this WOULD be correct
When the question asks for a solution to ensure high availability for virtual machines by distributing them across fault and update domains, deploying an availability set is the correct answer.
- ✗
A local user account on each VM
Why it's wrong here
A local user account on each VM exists only in that VM's Security Accounts Manager (SAM) database and is used for interactive or OS-level authentication and authorization, not for telemetry storage. Because accounts are created individually per machine, there is no aggregated, centralized query layer; you could not run a KQL query against local user accounts across multiple servers. Even if you audit the account, the audit events must still be forwarded to a workspace before they become queryable.
When this WOULD be correct
In a scenario where you need to provide administrative access to a VM without using Azure AD or domain accounts, deploying a local user account on each VM would be correct for local authentication.
- ✗
A network security group
Why it's wrong here
A network security group (NSG) filters and controls allowed or denied inbound/outbound traffic for a subnet or network interface. While you can configure diagnostic settings to send NSG flow logs to a Log Analytics workspace for analysis, the NSG itself is not a log repository or query engine. The flow logs are just another data source; without a workspace, an NSG does not enable any meaningful log search over collected VM data.
When this WOULD be correct
You need to control inbound and outbound traffic to virtual machines or subnets. For example, a question asking 'Which resource should you use to restrict access to a VM based on source IP address?' would have NSG as the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A Log Analytics workspaceCorrect answer▾
Why this is correct
A Log Analytics workspace is the central data repository and query platform for Azure Monitor Logs. Each workspace provides a unique log namespace where agents (such as Azure Monitor Agent or the legacy Log Analytics agent) and diagnostic settings deliver VM logs, performance counters, and events. You can then run KQL (Kusto Query Language) queries across all collected logs, create alerts, and build workbooks without having to access individual VMs.
✗An availability setWrong answer — click to see why▾
Why this is wrong here
An availability set is a logical grouping of VMs to ensure high availability during platform updates and failures; it does not provide log querying or retention capabilities.
★ When this WOULD be the correct answer
When the question asks for a solution to ensure high availability for virtual machines by distributing them across fault and update domains, deploying an availability set is the correct answer.
Why candidates choose this
Candidates may confuse 'availability' with 'data availability' for analysis, or mistakenly think that an availability set includes monitoring or logging features.
✗A local user account on each VMWrong answer — click to see why▾
Why this is wrong here
A local user account on each VM is used for authentication and access control, not for querying or retaining VM log data centrally with Kusto Query Language.
★ When this WOULD be the correct answer
In a scenario where you need to provide administrative access to a VM without using Azure AD or domain accounts, deploying a local user account on each VM would be correct for local authentication.
Why candidates choose this
Candidates may mistakenly think that local user accounts can be used to collect or query logs, confusing user management with log analytics capabilities.
✗A network security groupWrong answer — click to see why▾
Why this is wrong here
A network security group (NSG) filters traffic to and from Azure resources but does not collect, store, or query log data. It is not a data analytics or retention service.
★ When this WOULD be the correct answer
You need to control inbound and outbound traffic to virtual machines or subnets. For example, a question asking 'Which resource should you use to restrict access to a VM based on source IP address?' would have NSG as the correct answer.
Why candidates choose this
Candidates may confuse NSG diagnostic logs (which can be sent to Log Analytics) with the actual query and retention capability, or think NSGs inherently store log data for analysis.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.