AZ-104 Monitor and Maintain Azure Resources Practice Question
A team wants an email and SMS notification whenever the average CPU on a production VM stays above 85% for 10 minutes. The same notification setup may be reused by other alerts later. Which Azure feature should you configure?
⚠ Common exam trap
A common mix-up: candidates confuse the alert rule (which detects the condition) with the action group (which handles the notification), often selecting Metric Alert Rule thinking it directly sends emails/SMS, when in fact it only triggers the action group.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Action group
B is correct because an Action Group is the Azure component that defines the notification actions (email, SMS, webhook, etc.) to be triggered when an alert fires. The question specifies that the same notification setup should be reusable by other alerts later, which is exactly the purpose of an Action Group: it decouples the notification configuration from the alert rule itself. You would create a Metric Alert Rule to monitor the CPU metric, but that rule references an Action Group to send the email and SMS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Metric alert rule
Why it's wrong here
A metric alert rule monitors a resource metric such as average CPU usage and evaluates it against a threshold, but the rule itself does not store recipient contact information. To send email or SMS, the rule must reference an action group configured with those endpoints. Hence, while a metric alert rule is necessary to detect the condition, it alone cannot satisfy the notification requirement.
When this WOULD be correct
If the question asked for the feature that monitors a metric and triggers an alert based on a threshold (e.g., 'which feature fires when CPU exceeds 85% for 10 minutes?'), a metric alert rule would be correct.
- ✓
Action group
Why this is correct
An action group is the correct choice because it is the Azure Monitor component specifically designed to hold notification recipients. It defines email addresses, SMS phone numbers, webhooks, and other actions that can be attached to any number of alert rules, allowing reuse across multiple monitoring scenarios. When a metric alert triggers, it invokes the linked action group, which delivers the email and SMS messages.
- ✗
Diagnostic setting
Why it's wrong here
A diagnostic setting configures the streaming of platform logs and metrics to external destinations such as a Log Analytics workspace, storage account, or event hub for analysis or retention. It does not evaluate thresholds or manage delivery of notifications. To alert on the exported CPU data, you still need an alert rule and an action group, so a diagnostic setting is not sufficient by itself.
When this WOULD be correct
A diagnostic setting would be correct if the question asked for sending VM performance metrics to a Log Analytics workspace for long-term analysis or to Event Hubs for third-party integration, without requiring immediate notifications.
- ✗
Resource lock
Why it's wrong here
A resource lock only applies access-control protection at a scope, preventing deletion or modification of a resource; it does not collect or evaluate performance metrics. Locks are administrative controls to enforce governance, not monitoring controls. As a result, it has no capability to send email or SMS notifications about CPU averages.
When this WOULD be correct
A resource lock would be correct if the question asked: 'You need to prevent a critical VM from being accidentally deleted by administrators. Which Azure feature should you configure?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Action groupCorrect answer▾
Why this is correct
An action group is the correct choice because it is the Azure Monitor component specifically designed to hold notification recipients. It defines email addresses, SMS phone numbers, webhooks, and other actions that can be attached to any number of alert rules, allowing reuse across multiple monitoring scenarios. When a metric alert triggers, it invokes the linked action group, which delivers the email and SMS messages.
✗Metric alert ruleWrong answer — click to see why▾
Why this is wrong here
A metric alert rule defines the condition (CPU > 85% for 10 minutes) but does not include notification actions like email/SMS; it requires an action group to send notifications.
★ When this WOULD be the correct answer
If the question asked for the feature that monitors a metric and triggers an alert based on a threshold (e.g., 'which feature fires when CPU exceeds 85% for 10 minutes?'), a metric alert rule would be correct.
Why candidates choose this
Candidates confuse the alert rule (which detects the condition) with the action group (which handles notifications), thinking the rule itself sends emails/SMS.
✗Diagnostic settingWrong answer — click to see why▾
Why this is wrong here
Diagnostic settings collect and route metrics/logs to destinations like Log Analytics or storage, but they do not directly trigger email/SMS notifications. The alert rule and action group handle notifications.
★ When this WOULD be the correct answer
A diagnostic setting would be correct if the question asked for sending VM performance metrics to a Log Analytics workspace for long-term analysis or to Event Hubs for third-party integration, without requiring immediate notifications.
Why candidates choose this
Candidates may confuse diagnostic settings with alerting because both involve metrics, but diagnostic settings are about data collection and routing, not notification actions.
✗Resource lockWrong answer — click to see why▾
Why this is wrong here
Resource locks prevent accidental deletion or modification of Azure resources, but they do not provide any notification or alerting capabilities. The question requires email/SMS notifications based on a metric threshold, which is not a function of resource locks.
★ When this WOULD be the correct answer
A resource lock would be correct if the question asked: 'You need to prevent a critical VM from being accidentally deleted by administrators. Which Azure feature should you configure?'
Why candidates choose this
Candidates might confuse resource locks with governance or protection features, mistakenly thinking they can be used to enforce or notify about resource state changes.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Alert rule
An alert rule is a set of conditions and actions that trigger a notification when a monitored metric or log reaches a predefined threshold.
Key term
Action group
An Action group is a collection of notification and automation settings that defines how an Azure Monitor alert responds when triggered, such as who gets emailed, which phone numbers get called, or which automated tasks run.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.