A response team is designing notification paths for Azure Monitor alerts. Match each action group receiver or action to the outcome it provides.
Drag a concept onto its matching description — or click a concept then click the description.
Delivers the alert to a mailbox or distribution list.
Sends a text message to an on-call phone number.
Calls an external HTTPS endpoint such as a ticketing or orchestration system.
Runs custom code after the alert fires.
Starts a scripted remediation runbook in Azure Automation.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Email: Sends email notifications to specified recipients.
Email/SMS/Push/Voice are direct notifications; ITSM connector creates tickets; Automation runbook runs scripts; Webhook sends to external services like Teams; Push notifications target mobile apps.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Email: Sends email notifications to specified recipients.
Why this is correct
The Email action in an Azure Monitor action group sends an HTML-formatted email to a configured recipient address, making it a straightforward, low-cost alert delivery method. It is best suited for non-urgent notifications because delivery is asynchronous and can be blocked or delayed by spam filters. To ensure reliability, add the address to your safe-sender list and remember that each email receiver handles one address, though you can add multiple email receivers to the same action group to notify several people.
SMS: Sends SMS text messages to specified phone numbers.
Why this is correct
The SMS action sends a text message to a specified phone number, with a 160-character limit and support restricted to Azure-supported countries. This channel is valuable for urgent incidents because messages arrive directly on a mobile device, but you must account for per-message carrier fees and throttling—Azure limits delivery to roughly one SMS per five minutes per phone number to prevent flooding. It is best used for high-severity alerts that require immediate human attention, not for routine informational updates.
ITSM connector: Creates a ticket in an integrated IT Service Management system.
Why this is correct
The ITSM Connector action creates a work item—such as an incident, problem, or change request—inside a connected IT Service Management platform like ServiceNow or System Center Service Manager. It uses a secure HTTPS connection and requires the ITSM solution and the connector to be deployed in the same Azure resource group. This action is ideal when your organization's workflow depends on a formal ticketing system, because alert details are pushed directly into a ticket for tracking, assignment, and escalation rather than just notifying a person.
Automation runbook: Sends HTTP POST to an external service endpoint.
Why it's wrong here
The statement that an Automation runbook sends an HTTP POST to an external service endpoint is a misconception; that behavior belongs to a Webhook action. An Automation runbook executes a PowerShell or Python script in Azure Automation's sandbox, enabling actions such as shutting down a VM, patching a database, or running diagnostic tasks. To trigger a runbook directly from an alert, you specify the runbook name, service principal credentials, and parameters—not a URL endpoint.
Webhook: Runs a script in Azure Automation.
Why it's wrong here
A webhook is not a mechanism that runs a script in Azure Automation; that describes an Automation runbook's execution. Rather, a Webhook action performs an HTTP POST to a publicly reachable HTTPS URL, carrying a JSON payload with alert details. This is used to integrate with third-party systems or custom APIs, and the target endpoint must return a 2xx response within a few seconds; otherwise the webhook call is retried. Unlike a runbook, a webhook has no compute environment and simply transmits data to an external resource.
Go deeper
Learn chapter
Managed Identities for Azure Resources
Key term
Action group
An Action group is a collection of notification and automation settings that defines how an Azure Monitor alert responds when triggered, such as who gets emailed, which phone numbers get called, or which automated tasks run.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.