AZ-104 Monitor and Maintain Azure Resources Practice Question
A production VM is using too much CPU. You want Azure to notify the operations team by email when Average Percentage CPU stays above 80 percent for 5 minutes. What should you configure?
⚠ Common exam trap
Test-takers frequently confuse diagnostic settings (which only route data) with alert rules (which evaluate conditions and trigger actions), leading them to select Option A thinking it can send notifications directly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A metric alert rule linked to an action group
A metric alert rule monitors a specific metric (e.g., Percentage CPU) and triggers when a condition (e.g., above 80% for 5 minutes) is met. Linking the alert to an action group allows Azure to send email notifications to the operations team. This is the correct Azure Monitor feature for threshold-based, metric-driven notifications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A diagnostic setting on the VM
Why it's wrong here
A diagnostic setting only routes VM metrics and logs to a destination such as a Log Analytics workspace or an Azure storage account. It is a data collection configuration, not an evaluation or notification mechanism, so it cannot compare CPU utilization against a threshold. Even with guest-level diagnostics enabled, you still need a metric alert rule to act on the collected values.
When this WOULD be correct
A diagnostic setting would be correct if the question asked to stream VM metrics to a Log Analytics workspace for analysis or to archive metrics to a storage account for compliance.
- ✓
A metric alert rule linked to an action group
Why this is correct
A metric alert rule watches a platform metric such as CPU percentage and evaluates it against a threshold over time. Linking the alert to an action group lets Azure send the notification to the operations team by email or other channels when the condition is met.
- ✗
A Log Analytics workspace only
Why it's wrong here
A Log Analytics workspace acts purely as a centralized repository for telemetry, providing a query interface but no built-in delivery capability. To be notified about high CPU, you would have to create a separate scheduled query alert rule that runs the appropriate KQL and fires an action group. Merely ingesting CPU metrics into the workspace satisfies data residency or auditing needs, but it never contacts the operations team on its own.
When this WOULD be correct
A Log Analytics workspace would be correct if the question asked for a central location to collect and analyze performance data from multiple VMs for troubleshooting or reporting, without requiring real-time email notifications.
- ✗
An Azure Policy assignment
Why it's wrong here
Azure Policy enforces and audits compliance of resource configuration using code definitions like allowed locations or required tags, and it can apply remediation at deployment time. It does not read guest OS or platform performance counters such as CPU percentage, nor does it have a mechanism to send metric-triggered emails or SMS. Policies are designed for governance, not operational alerting, so assigning a policy cannot notify anyone when a VM is overutilized.
When this WOULD be correct
An Azure Policy assignment would be correct if the question asked how to enforce a rule that all VMs must have a specific diagnostic setting enabled, or to audit VMs that do not meet certain configuration standards (e.g., requiring a minimum number of data disks).
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A metric alert rule linked to an action groupCorrect answer▾
Why this is correct
A metric alert rule watches a platform metric such as CPU percentage and evaluates it against a threshold over time. Linking the alert to an action group lets Azure send the notification to the operations team by email or other channels when the condition is met.
✗A diagnostic setting on the VMWrong answer — click to see why▾
Why this is wrong here
A diagnostic setting on the VM sends metrics/logs to a destination (e.g., Storage, Event Hub, Log Analytics) but does not trigger email notifications or alerts based on metric thresholds.
★ When this WOULD be the correct answer
A diagnostic setting would be correct if the question asked to stream VM metrics to a Log Analytics workspace for analysis or to archive metrics to a storage account for compliance.
Why candidates choose this
Candidates may confuse diagnostic settings with alerting because both involve metrics, but diagnostic settings only route data, they do not evaluate conditions or send notifications.
✗A Log Analytics workspace onlyWrong answer — click to see why▾
Why this is wrong here
A Log Analytics workspace alone cannot send email notifications; it only collects and stores log data. The question requires an alert to notify the operations team by email, which necessitates an alert rule and action group.
★ When this WOULD be the correct answer
A Log Analytics workspace would be correct if the question asked for a central location to collect and analyze performance data from multiple VMs for troubleshooting or reporting, without requiring real-time email notifications.
Why candidates choose this
Candidates may think a Log Analytics workspace is sufficient because it can collect performance metrics and generate alerts, but they overlook that alerts require explicit configuration of alert rules and action groups to send notifications.
✗An Azure Policy assignmentWrong answer — click to see why▾
Why this is wrong here
Azure Policy is used to enforce organizational standards and assess compliance at scale, not to monitor and alert on performance metrics like CPU usage. It cannot trigger email notifications based on metric thresholds.
★ When this WOULD be the correct answer
An Azure Policy assignment would be correct if the question asked how to enforce a rule that all VMs must have a specific diagnostic setting enabled, or to audit VMs that do not meet certain configuration standards (e.g., requiring a minimum number of data disks).
Why candidates choose this
Candidates may confuse Azure Policy with monitoring and alerting capabilities, thinking it can be used to define rules that trigger actions like sending emails when conditions are met, due to the word 'policy' implying a rule-based response.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Action group
An Action group is a collection of notification and automation settings that defines how an Azure Monitor alert responds when triggered, such as who gets emailed, which phone numbers get called, or which automated tasks run.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.