An operations team monitors a group of Azure VMs and storage accounts. Match each Azure Monitor component to the behavior it provides in day-to-day operations.
Drag a concept onto its matching description — or click a concept then click the description.
Evaluates a numeric metric and fires when the threshold condition is met.
Sends the alert to chosen recipients or automation targets.
Shows Microsoft platform, region, or resource health incidents affecting the subscription.
Sends resource logs and metrics to Log Analytics, Event Hub, or Storage for later analysis.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Metrics: Collects numeric performance data from Azure resources.
Metrics give real-time performance; Logs store detailed events; Alerts trigger notifications; Workbooks visualize data; Autoscale adjusts capacity; Action Groups configure alert responses.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Metrics: Collects numeric performance data from Azure resources.
Why this is correct
Metrics in Azure Monitor are lightweight, numeric time-series values emitted by Azure resources at a regular cadence, such as CPU percentage, disk I/O throughput, or request latency. They are stored in a time-series database designed for near-real-time retrieval, which makes them ideal for low-latency dashboards, Autoscale triggers, and metric alerts. Unlike Logs, Metrics provide high-density performance telemetry without verbose context, and they are typically retained for 30 to 93 days depending on the resource type, forming the basis for quick, action-oriented monitoring.
Action Groups: Automatically adjusts the number of instances.
Why it's wrong here
Action Groups define the set of notification and remediation actions invoked when an alert fires, including email, SMS, push notifications to the Azure mobile app, voice calls, webhooks, ITSM tickets, or Azure functions (such as a webhook to run a runbook). They do not adjust the number of VM instances; that task is handled exclusively by Autoscale, which continuously evaluates metric thresholds or schedules to change capacity. An Action Group is merely a collection of receivers, and it is referenced by one or more alert rules to route response actions after a condition is already detected, not to scale resources.
Logs: Collects text-based event logs and traces from resources.
Why this is correct
Logs in Azure Monitor are text-based, semi-structured event records such as Windows event logs, Syslog messages, application traces, or custom diagnostic logs collected by Azure Diagnostics agents, Application Insights SDKs, or other sources. These records are ingested into a Log Analytics workspace, where they are indexed and queried using the Kusto Query Language (KQL), enabling complex correlation, root-cause analysis, and multi-resource trend detection across long retention periods. Unlike numeric Metrics, which provide near-real-time signals, Logs carry detailed contextual data but have higher ingestion latency, making them better suited for in-depth troubleshooting and historical analysis than for immediate threshold-based alerting.
Autoscale: Defines the notification preferences for alerts.
Why it's wrong here
Autoscale is a horizontal scaling capability in Azure Monitor that automatically increases or decreases the number of virtual machine instances, App Service plan workers, or Azure Virtual Machine Scale Set capacity based on metric thresholds (e.g., average CPU percentage) or a defined time schedule. Its core operation is executing scaling actions, and it does not define notification preferences for alerts; any notification that occurs during a scale event is sent through a separate Action Group configured within the Autoscale profile. Defining alert notifications is solely the function of Action Groups, not Autoscale, which is a capacity-control engine focused on matching resource count to demand.
Alerts: Sends proactive notifications based on metric or log rule conditions.
Why this is correct
Alerts in Azure Monitor are a monitoring component that evaluates rule-based conditions against either Metric signals or Log search results and, when the conditions are satisfied, proactively triggers a notification or an automated action through an associated Action Group. The alert rule specifies the target resource scope, the signal type (metric or log), the threshold or query logic, the evaluation frequency, and the action grouping, allowing operators to respond immediately to outages, threshold breaches, or pattern anomalies without manually inspecting dashboards. This makes Alerts the active notification layer of Azure Monitor, bridging raw telemetry (Metrics/Logs) to the responsive workflow in Action Groups.
Workbooks: Stores log data for long-term retention.
Why it's wrong here
Workbooks are interactive, reusable canvas-style reports inside Azure Monitor that visualize data by combining text, metric queries, log queries, and parameters into rich, customizable dashboards with tables, charts, and conditional formatting. They retrieve live data directly from Metrics and the Log Analytics workspace at render time, but they do not store, ingest, or Persist any log data; their role is purely presentation, analysis, and reporting. Long-term log retention is configured in the Log Analytics workspace through its data retention settings, not in Workbooks, and assigning them a storage capability confuses a visual analytics surface with a data persistence layer.
Go deeper
Learn chapter
Dynamic Membership Groups
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Azure Monitor
Azure Monitor is a cloud service that collects, analyzes, and acts on telemetry data from your Azure and on-premises resources to help you understand performance and availability.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.