AZ-104 Monitor and Maintain Azure Resources Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a log search alert on the VM performance data and attach a resource lock.

  Why it's wrong here

  A log search alert on VM performance data would require sending diagnostics to a Log Analytics workspace, adding cost and ingestion latency compared to a platform metric alert. A resource lock is designed to protect Azure resources from accidental deletion or modification; it cannot evaluate CPU thresholds or trigger notifications. Even if the log alert fired, without an action group attached there is no channel to actually contact the team, and the resource lock is entirely irrelevant to monitoring.

  When this WOULD be correct

  This option would be correct if the question required alerting based on custom log data (e.g., application logs) and also needed to prevent the alert rule from being deleted or modified, where a resource lock on the alert rule would be appropriate.

• ✓

  Create a metric alert on Percentage CPU and associate an action group with email and SMS receivers.

  Why this is correct

  Metric alerts are the best fit for near real-time threshold monitoring of Azure platform metrics such as CPU. An action group delivers the notification channels, such as email and SMS, when the alert fires. This design meets both parts of the requirement: detect sustained CPU pressure and notify the operations team automatically without needing log ingestion or manual polling.

• ✗

  Assign an Azure Policy definition to the VM to stop it when CPU exceeds the threshold.

  Why it's wrong here

  Azure Policy performs compliance evaluation and remediation of configurations on resources, such as tagging or allowed SKUs; it does not inspect runtime performance metrics like Percentage CPU. No built-in policy defines 'stop VM if CPU exceeds threshold,' and even a custom initiative cannot react dynamically to metric spikes because policy evaluation is not an event-driven alerting engine. Stopping a VM would also require an automation runbook or a conditional deployment, not a policy assignment, and it would not send a notification.

  When this WOULD be correct

  An administrator needs to enforce a rule that all VMs in a subscription must have a specific tag or must be deployed in a particular region. Azure Policy would be used to audit or enforce such compliance requirements.

• ✗

  Enable diagnostic settings on the VM and send the data only to a storage account.

  Why it's wrong here

  Diagnostic settings only stream performance counters and logs to a destination; a storage account is simply an archive sink. Without an alert rule that queries that data and without an action group, no email/SMS is ever generated, so the operations team remains unaware of CPU spikes. This approach enables post-incident analysis but fails the real-time notification requirement.

  When this WOULD be correct

  If the question asked for long-term archival of VM performance data for compliance or historical analysis, enabling diagnostic settings to send data to a storage account would be correct. For example: 'A company needs to store VM metrics for 3 years for auditing purposes.'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question