AZ-104 Monitor and Maintain Azure Resources Practice Question
Exhibit
Activity log export ------------------- Category: Administrative Destination: law-ops KQL draft --------- AzureActivity | where OperationNameValue == "Microsoft.Resources/subscriptions/resourcegroups/delete" | where Caller != "auto-remediate@contoso.com" Requirement ----------- Alert on resource group deletion events except when Caller is the automation account
Based on the exhibit, a subscription activity log is already being sent to Log Analytics. The operations team wants an alert that fires when any resource group is deleted, but it should ignore deletions performed by a known automation account. Which approach should the administrator use?
⚠ Common exam trap
Candidates often think a diagnostic setting on the resource group is needed to capture deletion events, but the activity log is already streaming at the subscription level and includes all resource group operations, making the additional setting redundant and incorrect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a log alert using the AzureActivity table and filter out the automation caller.
The AzureActivity table in Log Analytics captures all control-plane operations, including resource group deletions. By creating a log alert query that filters on OperationNameValue='MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE' and excludes Caller where it matches the automation account's service principal or object ID, the alert triggers only for non-automation deletions. This approach leverages the existing activity log stream to Log Analytics without additional configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a metric alert on CPU percentage for the subscription.
Why it's wrong here
A metric alert on CPU percentage monitors performance counters such as processor utilization for VMs or other resource metrics, not administrative operations like deletions. The activity log event for a deletion does not generate a CPU metric, and subscription-level metric alerts cover service health or resource health, not control-plane actions. Therefore this alert would never fire for the deletion, making it irrelevant to the requirement.
When this WOULD be correct
A metric alert on CPU percentage would be correct if the question asked for an alert when a specific VM's CPU exceeds a threshold, e.g., 'Create an alert when the average CPU percentage of VM1 is above 80% for 5 minutes.'
- ✓
Create a log alert using the AzureActivity table and filter out the automation caller.
Why this is correct
The AzureActivity table stores control-plane administrative events such as resource deletions, and a log alert rule uses a KQL query against that table to evaluate the event stream. To prevent routine automated cleanup from triggering alerts, the query should include a filter on the Caller property that excludes the automation account's principal name, and the OperationNameValue should match delete operations. This gives precise, real-time notification for unexpected deletions while ignoring the known automation caller.
- ✗
Enable a diagnostic setting on the resource group object.
Why it's wrong here
Diagnostic settings are used to export activity logs or resource logs to destinations like Event Hubs, Log Analytics, or storage, but they do not create alerts. A resource group is a management container, not a supported 'diagnostic setting' resource, and the deletion event already propagates to the activity log before any diagnostic setting matters. This option addresses log streaming, not alerting, so it cannot satisfy the requirement.
When this WOULD be correct
This option would be correct if the question asked: 'How to send resource group activity logs to a Log Analytics workspace for long-term retention and analysis?' In that case, enabling a diagnostic setting on the resource group would stream the logs.
- ✗
Apply an Azure Policy deny assignment to all deletions.
Why it's wrong here
Azure Policy's deny effect can only prevent resource operations at evaluation time, such as a deletion that violates a policy, but it cannot analyze historical activity log entries or generate notifications. Applying a blanket deny assignment to all deletions would actually block legitimate administrative and automated cleanup actions, and it does not provide an alert when a deletion occurs. This is a governance control, not an alerting mechanism, so it fails the stated requirement.
When this WOULD be correct
An Azure Policy deny assignment would be correct if the requirement was to prevent any resource group deletions (including those by automation accounts) rather than alerting on them. For example: 'The security team wants to block all resource group deletions across the subscription.'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a log alert using the AzureActivity table and filter out the automation caller.Correct answer▾
Why this is correct
The AzureActivity table stores control-plane administrative events such as resource deletions, and a log alert rule uses a KQL query against that table to evaluate the event stream. To prevent routine automated cleanup from triggering alerts, the query should include a filter on the Caller property that excludes the automation account's principal name, and the OperationNameValue should match delete operations. This gives precise, real-time notification for unexpected deletions while ignoring the known automation caller.
✗Create a metric alert on CPU percentage for the subscription.Wrong answer — click to see why▾
Why this is wrong here
The question requires an alert on resource group deletions, not performance metrics. A metric alert on CPU percentage cannot detect resource group deletion events.
★ When this WOULD be the correct answer
A metric alert on CPU percentage would be correct if the question asked for an alert when a specific VM's CPU exceeds a threshold, e.g., 'Create an alert when the average CPU percentage of VM1 is above 80% for 5 minutes.'
Why candidates choose this
Candidates may confuse metric alerts with log alerts, or think that any alert type can be used for operational events, not understanding that metric alerts only monitor numeric performance data.
✗Enable a diagnostic setting on the resource group object.Wrong answer — click to see why▾
Why this is wrong here
Enabling a diagnostic setting on the resource group object does not create alerts; it only streams logs to a destination. The question requires an alert on resource group deletions, which is not achieved by diagnostic settings alone.
★ When this WOULD be the correct answer
This option would be correct if the question asked: 'How to send resource group activity logs to a Log Analytics workspace for long-term retention and analysis?' In that case, enabling a diagnostic setting on the resource group would stream the logs.
Why candidates choose this
Candidates may confuse diagnostic settings with alert rules, thinking that enabling logging automatically triggers alerts, or they may believe that diagnostic settings can be used to filter and alert on specific activities.
✗Apply an Azure Policy deny assignment to all deletions.Wrong answer — click to see why▾
Why this is wrong here
Azure Policy deny assignment prevents resource creation or modification, but it does not generate alerts when deletions occur. The question requires an alert to fire on resource group deletion, not a preventive control.
★ When this WOULD be the correct answer
An Azure Policy deny assignment would be correct if the requirement was to prevent any resource group deletions (including those by automation accounts) rather than alerting on them. For example: 'The security team wants to block all resource group deletions across the subscription.'
Why candidates choose this
Candidates may confuse preventive controls (deny assignments) with detective controls (alerts), or think that blocking deletions is a simpler way to avoid unwanted deletions than setting up alerts.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
Key term
Activity log
An activity log is a record of all operations performed on Azure resources, capturing who did what, when, and where, for auditing and troubleshooting purposes.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.