AZ-104 Monitor and Maintain Azure Resources Practice Question
Exhibit
Azure Monitor > Alerts Rule name: HighCPU Scope: VM01 Condition: Percentage CPU > 80 for 5 minutes Status: Enabled Actions: None
Based on the exhibit, a metric alert already exists for VM01, but the on-call team never receives an email when CPU exceeds 80% for 5 minutes. What should you configure to deliver the notification?
⚠ Common exam trap
Watch out — candidates often confuse diagnostic settings (which export data) with action groups (which deliver notifications), or assume that simply creating an alert rule automatically sends notifications without an explicit action group.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an action group to the alert rule and configure email delivery.
The alert rule exists, but no notification action is configured. An action group defines how to notify administrators (e.g., email, SMS, webhook). Adding an action group with an email action to the existing alert rule will deliver the email when the CPU threshold is breached.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a diagnostic setting on VM01 to export metrics to Log Analytics.
Why it's wrong here
A diagnostic setting for VM01 exports metrics and logs to desaturated destinations such as a Log Analytics workspace, Storage account, or Event Hub for historical analysis and custom querying. This is a data collection and retention mechanism that enables you to build log-based search queries or visualize trends, but it does not trigger any real-time alerting, and it certainly does not send an email to the on-call team. The requested outcome—email notification when the metric threshold is breached—requires a properly configured action group attached to the alert rule.
When this WOULD be correct
This option would be correct if the question asked: 'You need to send VM performance data to a Log Analytics workspace for analysis and alerting. What should you configure?'
- ✓
Add an action group to the alert rule and configure email delivery.
Why this is correct
Action groups are the essential mechanism for alert notification delivery in Azure Monitor. When an alert rule fires, it invokes its configured action group, which can include email, SMS, voice, webhook, ITSM, and Automation runbook actions. To notify the on-call team via email, you must attach an action group configured with the appropriate email address or addresses to the existing alert rule; without this step, no notification is sent.
- ✗
Assign the Reader role to the on-call team so they can view the alert.
Why it's wrong here
Assigning the Reader role to the on-call team grants read-only access to resources, including the ability to view the alert rule, its configuration, and the metric data when they manually navigate to the Azure portal or query logs. However, the Reader role does not create any proactive notification mechanism; it merely permits access for a user who independently checks for alerts. Alert notifications are exclusively delivered through action groups configured on the alert rule, not through RBAC assignments.
When this WOULD be correct
If the question asked 'The on-call team cannot see the alert rule in the Azure portal. What should you configure?' then assigning the Reader role would grant read access to the alert rule.
- ✗
Create a resource lock on VM01 to prevent accidental changes.
Why it's wrong here
A resource lock at either the read-only or cannot-delete scope protects VM01 from accidental deletions or configuration changes, serving as a governance safeguard rather than a monitoring component. Locks have absolutely no effect on alert rules, metric evaluation, or notification delivery; they exist at the Azure Resource Manager control plane layer and do not interact with the data plane telemetry that triggers alerts. Therefore, applying a lock would do nothing to fulfill the requirement of emailing the on-call team when the alert fires.
When this WOULD be correct
If the question asked how to prevent accidental deletion or modification of a critical VM, creating a resource lock (e.g., CanNotDelete or ReadOnly) would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Add an action group to the alert rule and configure email delivery.Correct answer▾
Why this is correct
Action groups are the essential mechanism for alert notification delivery in Azure Monitor. When an alert rule fires, it invokes its configured action group, which can include email, SMS, voice, webhook, ITSM, and Automation runbook actions. To notify the on-call team via email, you must attach an action group configured with the appropriate email address or addresses to the existing alert rule; without this step, no notification is sent.
✗Create a diagnostic setting on VM01 to export metrics to Log Analytics.Wrong answer — click to see why▾
Why this is wrong here
The question states that a metric alert already exists, but no email is sent. The issue is with the alert's notification action, not with data collection. Exporting metrics to Log Analytics does not configure email delivery for the alert.
★ When this WOULD be the correct answer
This option would be correct if the question asked: 'You need to send VM performance data to a Log Analytics workspace for analysis and alerting. What should you configure?'
Why candidates choose this
Candidates may confuse diagnostic settings with alert actions, thinking that exporting metrics to Log Analytics will automatically trigger notifications, or they may believe that Log Analytics is required for alerting.
✗Assign the Reader role to the on-call team so they can view the alert.Wrong answer — click to see why▾
Why this is wrong here
Assigning the Reader role allows viewing alerts but does not enable email notifications; the alert rule lacks an action group to send emails.
★ When this WOULD be the correct answer
If the question asked 'The on-call team cannot see the alert rule in the Azure portal. What should you configure?' then assigning the Reader role would grant read access to the alert rule.
Why candidates choose this
Candidates may confuse permissions with notification delivery, thinking that granting read access somehow enables email alerts.
✗Create a resource lock on VM01 to prevent accidental changes.Wrong answer — click to see why▾
Why this is wrong here
A resource lock prevents deletion or modification of VM01, but does not affect alert notifications. The issue is that no email is sent when the alert fires, which requires an action group, not a lock.
★ When this WOULD be the correct answer
If the question asked how to prevent accidental deletion or modification of a critical VM, creating a resource lock (e.g., CanNotDelete or ReadOnly) would be the correct answer.
Why candidates choose this
Candidates may confuse resource locks with alert configuration, thinking that locking the VM ensures stability or that alerts are somehow tied to lock settings.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Functions for Administrators
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Action group
An Action group is a collection of notification and automation settings that defines how an Azure Monitor alert responds when triggered, such as who gets emailed, which phone numbers get called, or which automated tasks run.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.