Match each Azure monitoring service to its function.
Drag a concept onto its matching description — or click a concept then click the description.
Collect, analyze, and act on telemetry
Query and analyze log data
Application performance monitoring (APM)
Personalized recommendations for best practices
Personalized alerts for service issues
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Azure Monitor: Collects and analyzes telemetry from Azure resources
The correct matches are: Azure Monitor for telemetry collection, Log Analytics for log analysis, Application Insights for APM, and Azure Sentinel for security. Common confusions include swapping Azure Monitor with Application Insights or Log Analytics.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Azure Monitor: Collects and analyzes telemetry from Azure resources
Why this is correct
Azure Monitor is Microsoft's core platform service that ingests telemetry from Azure resources, including activity logs, resource logs, platform metrics, and guest OS data, into a consolidated data plane. It then normalizes and analyzes that data to power metrics charts, alerts, autoscale decisions, and workbooks. This broad infrastructure-level monitoring makes it the foundation of Azure observability, distinct from Log Analytics, which is the underlying store and query engine.
Log Analytics: Workspace for log data analysis and queries
Why this is correct
A Log Analytics workspace is the dedicated Azure Monitor data store where log-based telemetry from multiple sources is aggregated and made queryable. It provides the query environment using Kusto Query Language (KQL) to perform ad-hoc analysis, build log search alerts, and visualize results in workbooks. Although it is part of Azure Monitor, it does not itself collect telemetry from Azure resources; rather, it receives and organizes logs routed by Azure Monitor.
Application Insights: Application performance management (APM) and diagnostics
Why this is correct
Application Insights is Azure Monitor's application performance management (APM) capability that instruments live web applications to track request rates, response times, dependency calls, exceptions, and page views. It provides distributed tracing, user and session analytics, and availability tests, enabling developers to diagnose issues at the code level and correlate them across services. This application-centric observability is what sets it apart from Azure Monitor's platform-level telemetry collection.
Azure Sentinel: SIEM and SOAR solution for security operations
Why this is correct
Azure Sentinel, now Microsoft Sentinel, is a cloud-native SIEM and SOAR solution that ingests security logs from Microsoft 365, Microsoft Entra ID, Azure resources, and third-party security products. It uses analytics rules and machine learning to detect threats, and automated playbooks for incident response, while also offering hunting notebooks and threat intelligence. Unlike Azure Monitor, which focuses on general operational health, Sentinel is specifically designed for security operations and incident management.
Azure Monitor: Application performance management (APM) and diagnostics
Why it's wrong here
This pairing is inaccurate because Azure Monitor provides broad infrastructure-level telemetry collection and analysis, not focused application performance management. Application performance management with features like request and dependency tracking and distributed tracing is the specific domain of Application Insights, which is itself an Azure Monitor feature. Assigning APM to Azure Monitor conflates the platform-wide monitoring service with the application-level instrumentation tool.
Log Analytics: Collects and analyzes telemetry from Azure resources
Why it's wrong here
This pairing is incorrect because Log Analytics is not responsible for telemetry collection; that task belongs to Azure Monitor itself. The Log Analytics workspace is the storage and query engine where log data is held and analyzed, accepting data sent by Azure Monitor diagnostic settings and data collection rules. 'Collects and analyzes telemetry' describes the broader Azure Monitor service, while Log Analytics only analyzes the logs it receives.
Go deeper
About these practice questions
One of 795 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.