AZ-104 Monitor and Maintain Azure Resources Practice Question
Exhibit
Alert rule summary ------------------ Scope: vm-prod-01 Condition: Percentage CPU > 85 Evaluation frequency: 1 minute Window size: 10 minutes Severity: 2 Action groups: None Notifications: Not configured Status: Enabled Metric sample ------------- 12:00 CPU 72% 12:01 CPU 88% 12:02 CPU 91% 12:03 CPU 89% 12:04 CPU 87% 12:05 CPU 90% 12:06 CPU 86% 12:07 CPU 92% 12:08 CPU 94% 12:09 CPU 88%
Based on the exhibit, a production VM must send an email and SMS notification if average CPU stays above 85% for 10 minutes. The team created the alert rule, but no one receives notifications when the condition is met. What should the administrator add to the alert rule?
⚠ Common exam trap
A common mix-up: candidates think the alert rule itself includes notification settings, but Azure separates the alert condition (metric/log) from the notification mechanism (action group), so you must explicitly attach an action group to receive alerts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an action group that includes email and SMS receivers.
The alert rule is correctly configured to trigger when the average CPU exceeds 85% for 10 minutes, but notifications are not being sent because no action group is attached. An action group defines the notification channels (e.g., email, SMS, webhook) that fire when the alert is activated. Without an action group, the alert can fire silently, so the administrator must attach an action group containing the desired email and SMS receivers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a diagnostic setting that sends VM metrics to a Log Analytics workspace.
Why it's wrong here
Adding a diagnostic setting exports VM metrics to a Log Analytics workspace for querying, retention, and analysis, but it is a data-collection path, not a notification channel. Diagnostic settings do not create alerts or send messages to operators, and they cannot by themselves trigger email or SMS. The alert rule remains unlinked to any action group, so the notification requirement stays unmet.
When this WOULD be correct
If the question required analyzing historical CPU trends or correlating with other metrics, a diagnostic setting sending VM metrics to Log Analytics would be needed to enable log-based alerts or advanced queries.
- ✓
Attach an action group that includes email and SMS receivers.
Why this is correct
Azure Monitor alert rules need an action group to trigger notifications or automation when the metric condition is met. The alert already evaluates correctly, but it has no notification target. Adding an action group with email and SMS receivers enables the response the business wants.
- ✗
Change the alert to use a log query instead of a metric condition.
Why it's wrong here
Switching from a metric alert to a log query alert would change how the condition is evaluated, but the existing metric alert already detects the CPU threshold correctly. A log alert also still requires an action group to deliver email and SMS; without one, it would not notify anyone. The core deficiency is the missing notification target, not the alert signal source.
- ✗
Create a resource lock to prevent changes to the virtual machine.
Why it's wrong here
A resource lock prevents accidental deletion or modification of the virtual machine by placing a CanNotDelete or ReadOnly restriction at the resource scope. It has no relationship to monitoring or alerting behavior, so it cannot generate alerts or send email/SMS notifications when CPU utilization is high. Implementing a lock would add governance protection but would leave the action group requirement unresolved.
When this WOULD be correct
An administrator needs to ensure that a critical production VM cannot be accidentally deleted or modified. Adding a resource lock (e.g., CanNotDelete or ReadOnly) would be the correct solution to protect the VM from unintended changes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Attach an action group that includes email and SMS receivers.Correct answer▾
Why this is correct
Azure Monitor alert rules need an action group to trigger notifications or automation when the metric condition is met. The alert already evaluates correctly, but it has no notification target. Adding an action group with email and SMS receivers enables the response the business wants.
✗Add a diagnostic setting that sends VM metrics to a Log Analytics workspace.Wrong answer — click to see why▾
Why this is wrong here
The alert rule already uses a metric condition (CPU > 85% for 10 minutes), so sending metrics to Log Analytics is unnecessary for notification. The issue is that no action group is attached to the alert to send email/SMS.
★ When this WOULD be the correct answer
If the question required analyzing historical CPU trends or correlating with other metrics, a diagnostic setting sending VM metrics to Log Analytics would be needed to enable log-based alerts or advanced queries.
Why candidates choose this
Candidates may confuse diagnostic settings with alert actions, thinking that sending metrics to Log Analytics automatically enables notifications, or they may overcomplicate the solution by adding unnecessary monitoring infrastructure.
✗Create a resource lock to prevent changes to the virtual machine.Wrong answer — click to see why▾
Why this is wrong here
A resource lock prevents accidental deletion or modification of the VM, but it does not affect alert notifications. The issue is that no one receives notifications, which requires an action group, not a lock.
★ When this WOULD be the correct answer
An administrator needs to ensure that a critical production VM cannot be accidentally deleted or modified. Adding a resource lock (e.g., CanNotDelete or ReadOnly) would be the correct solution to protect the VM from unintended changes.
Why candidates choose this
Candidates may confuse resource locks with alert actions, thinking that locking the VM somehow secures the alert rule or prevents notification failures, but locks only affect management operations, not monitoring or notifications.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Alerts and Action Groups
Key term
Action group
An Action group is a collection of notification and automation settings that defines how an Azure Monitor alert responds when triggered, such as who gets emailed, which phone numbers get called, or which automated tasks run.
Key term
Alert rule
An alert rule is a set of conditions and actions that trigger a notification when a monitored metric or log reaches a predefined threshold.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to notify the operations team by email when average CPU utilization on VM-App01 exceeds 80 percent for 15 minutes. Which Azure Monitor components should you configure?
medium- ✓ A.A metric alert and an action group
- B.An activity log alert only
- C.A resource lock and Azure Advisor
- D.A budget alert
Why A: A metric alert monitors a specific performance metric (like CPU utilization) and triggers when a threshold is exceeded for a defined duration. An action group defines the notification action (e.g., sending an email) when the alert fires. Together, they meet the requirement to email the operations team when average CPU exceeds 80% for 15 minutes.
Variation 2. An operations team wants an email notification when the average CPU percentage on a VM stays above 85 percent for 10 minutes. Which two Azure Monitor components should they configure? Select two.
easy- ✓ A.A metric alert rule
- ✓ B.An action group
- C.Azure Bastion
- D.A Recovery Services vault
- E.A resource lock
Why A: A metric alert rule is correct because it monitors a specific VM performance metric (e.g., Percentage CPU) and triggers when the average value exceeds 85% for a duration of 10 minutes. An action group is required to define the notification method, such as sending an email, when the alert fires. Together, they enable email notifications for metric thresholds.
Variation 3. A team wants an email and SMS notification whenever the average CPU on a production VM stays above 85% for 10 minutes. The same notification setup may be reused by other alerts later. Which Azure feature should you configure?
easy- A.Metric alert rule
- ✓ B.Action group
- C.Diagnostic setting
- D.Resource lock
Why B: B is correct because an Action Group is the Azure component that defines the notification actions (email, SMS, webhook, etc.) to be triggered when an alert fires. The question specifies that the same notification setup should be reusable by other alerts later, which is exactly the purpose of an Action Group: it decouples the notification configuration from the alert rule itself. You would create a Metric Alert Rule to monitor the CPU metric, but that rule references an Action Group to send the email and SMS.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.