AZ-104 Practice Question 40: Diagnostic Settings Log Analytics

Microsoft Azure Administrator Associate (AZ-104) · Test 4 · question 10 of 10

Monitoring & Backuphard

A security team wants to correlate, in one place and with KQL queries:

- Key vault audit events and storage account read operations, and - who changed what in the subscription (the activity log),

with a year of retention. A Log Analytics workspace exists. Opening Logs and querying AzureDiagnostics returns nothing at all, and AzureActivity is empty too.

What must you do?

Show answer and explanation

Answer:

C. Create a diagnostic setting on each resource, and a subscription-level diagnostic setting for the activity log, each sending to the Log Analytics workspace

Diagnostic settings are the routing mechanism for platform telemetry: you "use diagnostic settings in Azure Monitor to collect resource logs and to send platform metrics and the activity log to various destinations," and you "create a separate diagnostic setting for each resource that you want to collect data from." The two sources behave differently, which is why both halves of the answer are needed: resource logs "aren't collected by default. Create a diagnostic setting to collect resource logs," while the activity log is "automatically collected without configuration" but needs a subscription-scope diagnostic setting to be sent anywhere you can query it. Once the data arrives, the workspace tables "are created automatically when the first data is sent," and the workspace retention setting covers the year.

Option A is the belief that makes teams think Azure Monitor is broken. Nothing lands in the workspace until a setting routes it there, which is exactly why the queries return no rows.

Option B confuses two data types. Platform metrics are collected automatically and viewable in metrics explorer without any setting, and they land in metric tables, not the resource-log tables. Sending metrics to a workspace is optional and does not bring logs with it.

Option D is the right pattern for a different data source. The Azure Monitor Agent with a data collection rule gathers guest-level data from virtual machines; a key vault or a storage account has no guest to install an agent on.

Reference: Diagnostic settings in Azure Monitor

Practice Test 4 ›

Study guides for AZ-104

Azure Administrator (AZ-104): jobs, salary and the examAzure administrator role, jobs and pay data, and the AZ-104 exam: five domains, 100 minutes, US$165 / ₹4,865, AZ-900 first or not, and what next.

AZ-400 exam guide: DevOps Engineer Expert in 2026AZ-400 exam guide: the DevOps Engineer Expert prerequisites now that AZ-204 is retired, the five skill areas, price, renewal and a study plan.

Azure certification path 2026: AZ-900, AZ-104, AZ-305The Azure certification path for 2026 - AZ-900, AZ-104 and AZ-305 in order, what each covers, the AZ-305 prerequisite, renewal and what to skip.

Azure RBAC vs Azure Policy vs Entra roles vs resource locksHow Azure RBAC, Azure Policy, Microsoft Entra roles and resource locks differ, how scope inheritance works, and when deny beats audit.

Azure Storage redundancy - LRS, ZRS, GRS, GZRS and failoverHow LRS, ZRS, GRS, RA-GRS, GZRS and RA-GZRS differ, what failover does to your account, and how access tiers interact with redundancy.