Pass Your Microsoft AZ-104 Exam Easy!

The nearby action 'Verify collection timestamps and fresh telemetry arrival' is associated with this separate need: an Insights dashboard shows yesterday's healthy state after today's failed deployment. That is because a stale visualization is not current evidence that a workload recovered. Here CPU peaks began near a deployment, and an engineer asserts the deployment caused them, so 'Verify collection timestamps and fresh telemetry arrival' misses the fact that temporal coincidence is not proof of causation; workload and configuration telemetry should be compared. 'Correlate deployment events with workload metrics and test alternative causes' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Choose sustained aggregation and evaluation windows for the CPU metric' solves another task because time grain and aggregation determine whether transient peaks satisfy the alert condition. For the situation where CPU peaks began near a deployment, and an engineer asserts the deployment caused them, this distractor misses the requirement that temporal coincidence is not proof of causation; workload and configuration telemetry should be compared. Unlike 'Choose sustained aggregation and evaluation windows for the CPU metric', 'Correlate deployment events with workload metrics and test alternative causes' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When operations want an alert within minutes of VM CPU over 90%, but a colleague suggests parsing one-day-old security logs, the action 'Use an Azure Monitor platform metric with suitable time grain' can be relevant: platform metrics suit near-real-time numeric thresholds; logs are for queryable events and detail. For the different problem of CPU peaks began near a deployment, and an engineer asserts the deployment caused them, 'Use an Azure Monitor platform metric with suitable time grain' misses the mechanism that temporal coincidence is not proof of causation; workload and configuration telemetry should be compared. Choosing 'Use an Azure Monitor platform metric with suitable time grain' would address that other need, whereas 'Correlate deployment events with workload metrics and test alternative causes' is intended to solve the stated condition.

The nearby action 'Verify resource selection, scope and availability of the particular metric' is associated with this separate need: a dashboard shows no CPU metric for a VM newly selected in the wrong subscription scope. That is because missing chart data may reflect query scope rather than zero CPU load. Here several storage accounts share a metric chart but only one shows elevated transaction errors, so 'Verify resource selection, scope and availability of the particular metric' misses the fact that aggregating multiple accounts can hide which resource produces the error signal. 'Filter or split by the relevant resource and metric dimension' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Set an Azure Monitor metric alert with measured aggregation and evaluation window' solves another task because a metric alert evaluates the numeric signal; notification is delegated to an action group. For the situation where several storage accounts share a metric chart but only one shows elevated transaction errors, this distractor misses the requirement that aggregating multiple accounts can hide which resource produces the error signal. Unlike 'Set an Azure Monitor metric alert with measured aggregation and evaluation window', 'Filter or split by the relevant resource and metric dimension' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Review a relevant high percentile latency metric instead of only the mean' applies to a different feature boundary because percentiles expose tail latency hidden by a low average and should use comparable sample windows. In the stated scenario where several storage accounts share a metric chart but only one shows elevated transaction errors, 'Review a relevant high percentile latency metric instead of only the mean' does not satisfy the mechanism that aggregating multiple accounts can hide which resource produces the error signal. The necessary action is 'Filter or split by the relevant resource and metric dimension', which should be checked against this Azure resource's actual permissions and state.

'Check the configured aggregation window, threshold and evaluation frequency' solves another task because an alert condition may need multiple samples or an aggregate, not an isolated measurement. For the situation where CPU exceeded 75% for one sample, but the autoscale rule requires sustained 10-minute average, this distractor misses the requirement that a single peak is insufficient when a sustained aggregate is the configured predicate. Unlike 'Check the configured aggregation window, threshold and evaluation frequency', 'Evaluate the rule's actual aggregation and evaluation periods' directly targets that requirement; its success must be confirmed at the authorized resource scope.

An autoscale rule based on a sustained average evaluates its configured aggregation and evaluation windows, not simply the largest single sample. One CPU value above 75% cannot prove the 10-minute average met the condition. The reviewer must inspect the actual window, aggregation type and sampled metric series before declaring that the rule should have triggered. Treating a spike as a sustained breach changes the defined decision rule.

The nearby action 'Review a relevant high percentile latency metric instead of only the mean' is associated with this separate need: most requests are fast but a small subset exceeds the latency SLA; average latency looks normal. That is because percentiles expose tail latency hidden by a low average and should use comparable sample windows. Here CPU exceeded 75% for one sample, but the autoscale rule requires sustained 10-minute average, so 'Review a relevant high percentile latency metric instead of only the mean' misses the fact that a single peak is insufficient when a sustained aggregate is the configured predicate. 'Evaluate the rule's actual aggregation and evaluation periods' is the more defensible action; confirm its behavior in the target service before calling the task complete.

A successfully saved diagnostic setting proves configuration was accepted, not that a particular audit event has already been generated, transported and indexed. Azure Monitor resource logs may have ingestion latency and are emitted only for the selected source categories. The compliance requirement specifically asks that Key Vault accesses be searchable in the intended workspace, so check actual event arrival, table selection and authorized query access after configuring the AuditEvent category and routing destination. Merely observing a green setting without emitted records does not validate the monitoring outcome.

Azure Activity Log primarily records subscription-level and control-plane operations; it is not a replacement for the full Key Vault AuditEvent resource-log stream describing access to secrets, keys and vault authorization operations. The user needs those resource events in an approved Log Analytics workspace, not an inference from unrelated subscription changes. Configure diagnostic logging at the Key Vault, select AuditEvent, send it to the intended workspace and query AZKVAuditLogs or AzureDiagnostics according to collection mode. An Activity Log-only query can omit the precise access evidence needed by the compliance team.

A diagnostic setting can be technically valid while sending Key Vault events to another workspace, but a query in the expected workspace will then return nothing for those records. For this compliance case, the team must verify the actual destination instead of assuming resources inherit a default logging location. Enabling AuditEvent at the source is necessary but insufficient if the workspace route is incorrect. Route to the authorized destination and validate ingested events using the table required by the diagnostic collection mode and the Key Vault resource ID.

The nearby action 'Inspect diagnostic setting destinations and query the actual receiving workspace' is associated with this separate need: a team's Kusto query returns no recent firewall denies because diagnostics were sent to a different workspace. That is because log routing and table selection must match; empty results do not imply no failed events. Here a teammate searches the Azure Activity Log for application query failures recorded inside a database service, so 'Inspect diagnostic setting destinations and query the actual receiving workspace' misses the fact that activity Logs mainly track management operations; resource diagnostics capture supported service events. 'Use service diagnostic logs rather than only control-plane Activity Log events' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Select the applicable Blob/storage diagnostic log categories and destination' solves another task because without matching diagnostic categories and a valid sink, a log query cannot reconstruct absent data-plane events. For the situation where a teammate searches the Azure Activity Log for application query failures recorded inside a database service, this distractor misses the requirement that activity Logs mainly track management operations; resource diagnostics capture supported service events. Unlike 'Select the applicable Blob/storage diagnostic log categories and destination', 'Use service diagnostic logs rather than only control-plane Activity Log events' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an administrator needs Azure Key Vault audit events searchable in Log Analytics for compliance triage, the action 'Configure supported diagnostic settings to an appropriate Log Analytics workspace' can be relevant: diagnostic categories must be enabled at the resource, routed to the workspace, and queried after records arrive. For the different problem of a teammate searches the Azure Activity Log for application query failures recorded inside a database service, 'Configure supported diagnostic settings to an appropriate Log Analytics workspace' misses the mechanism that activity Logs mainly track management operations; resource diagnostics capture supported service events. Choosing 'Configure supported diagnostic settings to an appropriate Log Analytics workspace' would address that other need, whereas 'Use service diagnostic logs rather than only control-plane Activity Log events' is intended to solve the stated condition.

A diagnostic setting must send the relevant Blob Storage log categories to a destination the investigation can actually query. Pointing telemetry to an unrelated workspace without appropriate access does not meet the requirement to review failed operations by client and outcome. The appropriate solution is to select the relevant service logs and approved workspace, account for ingestion delay and query the resulting records. Destination selection matters as much as enabling a generic setting.

Azure Activity Log primarily captures management-plane subscription events, not the detailed data-plane object access and failure records needed to identify unsuccessful blob reads by client. The question asks for operation-level storage evidence. Configure the supported Blob service diagnostic categories and send them to an authorized destination such as Log Analytics, then query the relevant records. Management events alone cannot provide the requested data-access attribution.

When a diagnostic setting was enabled two minutes ago and the dashboard still lacks records, the action 'Check ingestion latency and source emission before declaring collection broken' can be relevant: diagnostic pipelines are asynchronous; absence immediately after setup is not definitive failure. For the different problem of a storage account's failed data reads must be investigated by operation and client, 'Check ingestion latency and source emission before declaring collection broken' misses the mechanism that without matching diagnostic categories and a valid sink, a log query cannot reconstruct absent data-plane events. Choosing 'Check ingestion latency and source emission before declaring collection broken' would address that other need, whereas 'Select the applicable Blob/storage diagnostic log categories and destination' is intended to solve the stated condition.

'Inspect diagnostic setting destinations and query the actual receiving workspace' applies to a different feature boundary because log routing and table selection must match; empty results do not imply no failed events. In the stated scenario where a storage account's failed data reads must be investigated by operation and client, 'Inspect diagnostic setting destinations and query the actual receiving workspace' does not satisfy the mechanism that without matching diagnostic categories and a valid sink, a log query cannot reconstruct absent data-plane events. The necessary action is 'Select the applicable Blob/storage diagnostic log categories and destination', which should be checked against this Azure resource's actual permissions and state.

Creating or replacing a diagnostic setting can change where future platform logs are delivered, but the question explicitly forbids changes to the existing destinations. It also would not make already-ingested records from LAW-Archive appear retroactively in LAW-Ops. Troubleshooting should first identify the actual destination configured for this storage account and query that workspace, with the correct table category and target-resource filter. A separately approved change could route future logs to a different workspace later; it is not the immediate supported answer under the change freeze.

A correct Kusto table and resource filter are necessary for finding a particular log event, but they cannot create entries in a workspace to which the diagnostic setting never sent them. The scenario says LAW-Archive is the active destination while the team is querying LAW-Ops. Changing table or filter details only in LAW-Ops will still return zero records from LAW-Archive unless an explicit cross-workspace query is used with appropriate permissions. The immediate first step is to inspect and query the real receiving workspace; ingestion latency and schema must then be considered there.

An Azure subscription Activity Log records control-plane and subscription events; it is not a replacement for the selected storage-service resource log categories that contain request-level diagnostics. Disabling a working diagnostic setting would interrupt the requested evidence collection. Because the setting already sends logs to LAW-Archive, the correct action is to leave that transport configuration intact and query LAW-Archive for the relevant resource and category. Confirm that the requested firewall-related events are available from the selected diagnostics and their ingestion timeline rather than assuming every denial is represented identically.

When a storage account's failed data reads must be investigated by operation and client, the action 'Select the applicable Blob/storage diagnostic log categories and destination' can be relevant: without matching diagnostic categories and a valid sink, a log query cannot reconstruct absent data-plane events. For the different problem of a compliance team retains verbose diagnostics indefinitely without evaluating ingestion costs, 'Select the applicable Blob/storage diagnostic log categories and destination' misses the mechanism that log ingestion, searchable retention and archive features have pricing and policy constraints. Choosing 'Select the applicable Blob/storage diagnostic log categories and destination' would address that other need, whereas 'Set deliberate Log Analytics retention, collection scope and cost controls' is intended to solve the stated condition.

'Use service diagnostic logs rather than only control-plane Activity Log events' applies to a different feature boundary because activity Logs mainly track management operations; resource diagnostics capture supported service events. In the stated scenario where a compliance team retains verbose diagnostics indefinitely without evaluating ingestion costs, 'Use service diagnostic logs rather than only control-plane Activity Log events' does not satisfy the mechanism that log ingestion, searchable retention and archive features have pricing and policy constraints. The necessary action is 'Set deliberate Log Analytics retention, collection scope and cost controls', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Configure supported diagnostic settings to an appropriate Log Analytics workspace' is associated with this separate need: an administrator needs Azure Key Vault audit events searchable in Log Analytics for compliance triage. That is because diagnostic categories must be enabled at the resource, routed to the workspace, and queried after records arrive. Here a compliance team retains verbose diagnostics indefinitely without evaluating ingestion costs, so 'Configure supported diagnostic settings to an appropriate Log Analytics workspace' misses the fact that log ingestion, searchable retention and archive features have pricing and policy constraints. 'Set deliberate Log Analytics retention, collection scope and cost controls' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Inspect diagnostic setting destinations and query the actual receiving workspace' applies to a different feature boundary because log routing and table selection must match; empty results do not imply no failed events. In the stated scenario where a diagnostic setting was enabled two minutes ago and the dashboard still lacks records, 'Inspect diagnostic setting destinations and query the actual receiving workspace' does not satisfy the mechanism that diagnostic pipelines are asynchronous; absence immediately after setup is not definitive failure. The necessary action is 'Check ingestion latency and source emission before declaring collection broken', which should be checked against this Azure resource's actual permissions and state.

'Configure supported diagnostic settings to an appropriate Log Analytics workspace' solves another task because diagnostic categories must be enabled at the resource, routed to the workspace, and queried after records arrive. For the situation where a diagnostic setting was enabled two minutes ago and the dashboard still lacks records, this distractor misses the requirement that diagnostic pipelines are asynchronous; absence immediately after setup is not definitive failure. Unlike 'Configure supported diagnostic settings to an appropriate Log Analytics workspace', 'Check ingestion latency and source emission before declaring collection broken' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a storage account's failed data reads must be investigated by operation and client, the action 'Select the applicable Blob/storage diagnostic log categories and destination' can be relevant: without matching diagnostic categories and a valid sink, a log query cannot reconstruct absent data-plane events. For the different problem of a diagnostic setting was enabled two minutes ago and the dashboard still lacks records, 'Select the applicable Blob/storage diagnostic log categories and destination' misses the mechanism that diagnostic pipelines are asynchronous; absence immediately after setup is not definitive failure. Choosing 'Select the applicable Blob/storage diagnostic log categories and destination' would address that other need, whereas 'Check ingestion latency and source emission before declaring collection broken' is intended to solve the stated condition.

The nearby action 'Configure supported diagnostic settings to an appropriate Log Analytics workspace' is associated with this separate need: an administrator needs Azure Key Vault audit events searchable in Log Analytics for compliance triage. That is because diagnostic categories must be enabled at the resource, routed to the workspace, and queried after records arrive. Here a workspace holds many services, but the investigator needs failures for one VM only, so 'Configure supported diagnostic settings to an appropriate Log Analytics workspace' misses the fact that workspace-wide error counts can conflate unrelated resources and signal types. 'Filter by the intended resource ID and failure conditions in the correct log table' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When a query of one workspace table returns no results though resource diagnostic logs are visible elsewhere, the action 'Validate table schema, workspace destination and resource scope' can be relevant: wrong table or scope produces empty results even when valid telemetry exists in another location. For the different problem of a workspace holds many services, but the investigator needs failures for one VM only, 'Validate table schema, workspace destination and resource scope' misses the mechanism that workspace-wide error counts can conflate unrelated resources and signal types. Choosing 'Validate table schema, workspace destination and resource scope' would address that other need, whereas 'Filter by the intended resource ID and failure conditions in the correct log table' is intended to solve the stated condition.

'Join appropriate log tables on a trustworthy shared correlation key' applies to a different feature boundary because unrelated rows should not be joined by approximate time alone when a request identity exists. In the stated scenario where a workspace holds many services, but the investigator needs failures for one VM only, 'Join appropriate log tables on a trustworthy shared correlation key' does not satisfy the mechanism that workspace-wide error counts can conflate unrelated resources and signal types. The necessary action is 'Filter by the intended resource ID and failure conditions in the correct log table', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Inspect diagnostic setting destinations and query the actual receiving workspace' is associated with this separate need: a team's Kusto query returns no recent firewall denies because diagnostics were sent to a different workspace. That is because log routing and table selection must match; empty results do not imply no failed events. Here a workspace holds many services, but the investigator needs failures for one VM only, so 'Inspect diagnostic setting destinations and query the actual receiving workspace' misses the fact that workspace-wide error counts can conflate unrelated resources and signal types. 'Filter by the intended resource ID and failure conditions in the correct log table' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use explicit UTC-aware time filtering and consistent window boundaries' solves another task because timestamp interpretation affects which events fall inside daily reporting periods. For the situation where a report must show HTTP error count per status code without losing detail for investigation, this distractor misses the requirement that aggregates show distribution; raw records supply timestamp and correlation needed for root cause. Unlike 'Use explicit UTC-aware time filtering and consistent window boundaries', 'Use Kusto summarize count by status while retaining access to raw events' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Join appropriate log tables on a trustworthy shared correlation key' applies to a different feature boundary because unrelated rows should not be joined by approximate time alone when a request identity exists. In the stated scenario where a report must show HTTP error count per status code without losing detail for investigation, 'Join appropriate log tables on a trustworthy shared correlation key' does not satisfy the mechanism that aggregates show distribution; raw records supply timestamp and correlation needed for root cause. The necessary action is 'Use Kusto summarize count by status while retaining access to raw events', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Normalize units, aggregation and sampling semantics before comparing metrics and logs' is associated with this separate need: a developer compares a metric's per-minute average with raw event counts from logs as though they share units. That is because numeric metrics and event records describe different measurements and collection windows. Here a report must show HTTP error count per status code without losing detail for investigation, so 'Normalize units, aggregation and sampling semantics before comparing metrics and logs' misses the fact that aggregates show distribution; raw records supply timestamp and correlation needed for root cause. 'Use Kusto summarize count by status while retaining access to raw events' is the more defensible action; confirm its behavior in the target service before calling the task complete.