AZ-104 Monitor and Maintain Azure Resources Practice Question
A production VM needs an email and SMS notification when CPU percentage stays above 80 percent for five minutes. Which two Azure Monitor components should the administrator configure? Select two.
⚠ Common exam trap
Many candidates confuse Log Analytics workspace (which can also generate alerts from log queries) with the metric-based alerting required for CPU percentage, or mistakenly think a Recovery Services vault is involved in monitoring notifications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Action group
A Metric alert rule monitors the VM’s CPU percentage metric and triggers when the condition (above 80% for 5 minutes) is met. An Action group defines the notification actions (email and SMS) that are executed when the alert fires. Together, they enable the required notification workflow.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Action group
Why this is correct
The action group is the Azure Monitor component that defines the delivery endpoints for notifications—such as email addresses, SMS phone numbers, webhooks, and ITSM connectors. When a metric alert rule detects that CPU utilization has crossed a threshold, it invokes the associated action group, which then sends the email/SMS. Without an action group linked to the alert rule, the alert would fire but would have no way to notify anyone, so it is a required part of the solution.
- ✗
Azure Policy assignment
Why it's wrong here
An Azure Policy assignment applies a governance policy that enforces rules on Azure resources, such as requiring resource groups to have a specific tag or restricting VM sizes, and it evaluates compliance at creation or update time. It does not track real-time telemetry such as CPU percentage, nor does it have a mechanism to send email/SMS notifications based on performance thresholds. Thus, it is not relevant to alerting a production VM's CPU usage.
When this WOULD be correct
An administrator needs to ensure all VMs in a subscription have a specific tag (e.g., 'Environment: Production') and automatically remediate non-compliant VMs. In this scenario, an Azure Policy assignment with a 'deny' or 'deployIfNotExists' effect would be correct.
- ✓
Metric alert rule
Why this is correct
A metric alert rule continuously monitors a specific metric such as 'Percentage CPU' for a virtual machine and evaluates it against a user-defined threshold and time window (e.g., 90% for 5 minutes). When the condition is met, the rule fires and triggers its linked action group to send the email and SMS notifications. It is correct because it provides the detection logic that causes the notification to be sent; without the rule, no one would ever be alerted about high CPU usage.
- ✗
Recovery Services vault
Why it's wrong here
A Recovery Services vault is a management and storage container for Azure Backup and Azure Site Recovery, designed to hold recovery points, configure backup policies, and replicate virtual machines to another region. It does not monitor live performance metrics like CPU usage, and its own alerts are limited to backup failures, missing backups, or replication health. Therefore, it cannot be used to generate email/SMS notifications when a VM's CPU usage spikes.
When this WOULD be correct
A Recovery Services vault would be correct if the question asked about configuring backup for an Azure VM, such as scheduling daily backups and setting up retention policies.
- ✗
Log Analytics workspace
Why it's wrong here
A Log Analytics workspace is a centralized repository for collecting and querying diagnostic logs and metrics, and it can be used by log alert rules that search over ingested data. However, a metric alert on CPU utilization queries the metric store directly and does not require a Log Analytics workspace; the workspace also cannot deliver email/SMS notifications on its own—that still requires an action group. Adding a Log Analytics workspace would introduce unnecessary complexity and cost for this requirement.
When this WOULD be correct
A Log Analytics workspace would be correct if the question asked for a component to collect and analyze performance logs from multiple VMs, or to query historical CPU data for troubleshooting, without requiring real-time alerting.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Action groupCorrect answer▾
Why this is correct
The action group is the Azure Monitor component that defines the delivery endpoints for notifications—such as email addresses, SMS phone numbers, webhooks, and ITSM connectors. When a metric alert rule detects that CPU utilization has crossed a threshold, it invokes the associated action group, which then sends the email/SMS. Without an action group linked to the alert rule, the alert would fire but would have no way to notify anyone, so it is a required part of the solution.
✗Azure Policy assignmentWrong answer — click to see why▾
Why this is wrong here
Azure Policy assignment enforces compliance rules on resources (e.g., tagging, SKU restrictions) and does not send notifications based on performance metrics like CPU percentage.
★ When this WOULD be the correct answer
An administrator needs to ensure all VMs in a subscription have a specific tag (e.g., 'Environment: Production') and automatically remediate non-compliant VMs. In this scenario, an Azure Policy assignment with a 'deny' or 'deployIfNotExists' effect would be correct.
Why candidates choose this
Candidates may confuse Azure Policy with monitoring or alerting, thinking it can trigger notifications for performance issues, but Policy is for governance and compliance, not real-time metric alerts.
✗Recovery Services vaultWrong answer — click to see why▾
Why this is wrong here
A Recovery Services vault is used for Azure Backup and Azure Site Recovery, not for monitoring or alerting. It cannot send email or SMS notifications based on CPU metrics.
★ When this WOULD be the correct answer
A Recovery Services vault would be correct if the question asked about configuring backup for an Azure VM, such as scheduling daily backups and setting up retention policies.
Why candidates choose this
Candidates may confuse Recovery Services vault with monitoring tools because both involve 'recovery' or 'alerts', or they might think it is needed for VM health monitoring.
✗Log Analytics workspaceWrong answer — click to see why▾
Why this is wrong here
A Log Analytics workspace is used for collecting and analyzing log data, not for sending email or SMS notifications based on CPU metrics. The notification action requires an action group, not a Log Analytics workspace.
★ When this WOULD be the correct answer
A Log Analytics workspace would be correct if the question asked for a component to collect and analyze performance logs from multiple VMs, or to query historical CPU data for troubleshooting, without requiring real-time alerting.
Why candidates choose this
Candidates may confuse Log Analytics with monitoring and assume it can directly send notifications, or they think metric data must be stored in Log Analytics before alerting, overlooking that metric alerts can work independently.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Alert rule
An alert rule is a set of conditions and actions that trigger a notification when a monitored metric or log reaches a predefined threshold.
Key term
Action group
An Action group is a collection of notification and automation settings that defines how an Azure Monitor alert responds when triggered, such as who gets emailed, which phone numbers get called, or which automated tasks run.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.