Based on the exhibit, a subscription activity log is already being sent to Log Analytics. The operations team wants an alert that fires when any resource group is deleted, but it should ignore deletions performed by a known automation account. Which approach should the administrator use?

Create a metric alert on CPU percentage for the subscription.

CPU metrics do not describe administrative deletions. The requirement is based on activity logs, not platform performance.

Enable a diagnostic setting on the resource group object.

Resource groups do not use diagnostic settings in the same way as platform resources. The event already exists in the activity log export.

Apply an Azure Policy deny assignment to all deletions.

Policy can restrict resource creation or configuration, but it does not analyze historical log entries or create alerts from them.

What does this AZ-104 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Create a log alert using the AzureActivity table and filter out the automation caller. — Resource group deletion is an administrative event that appears in AzureActivity. Because the team already exports activity logs to Log Analytics, the right solution is a log alert built from a KQL query. The query can filter on the delete operation and exclude events where the caller is the trusted automation account, ensuring the alert is both accurate and actionable. Why others are wrong: A CPU metric alert is unrelated to administrative changes. Diagnostic settings are not the issue because the activity log is already being collected. Azure Policy governs compliance and deployment behavior, but it does not replace log-based detection of past events.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.