AZ-104 Monitor and Maintain Azure Resources Practice Question
Exhibit
Current alert design -------------------- Alert 1: CPU on VM-Prod-01 Alert 2: Disk queue length on VM-Prod-02 Alert 3: Availability check on web-app-01 Requirements ------------ - Send email, SMS, and webhook notifications - Reuse the same notification target across multiple alerts - Minimize repeated configuration
Based on the exhibit, the team wants a single notification setup that can be reused by several alert rules across different subscriptions. What should the administrator create?
⚠ Common exam trap
Many exam-takers confuse management groups (which organize subscriptions) with action groups (which handle notifications), mistakenly thinking a management group can centralize alert notifications across subscriptions when it cannot.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An action group
An action group is the correct choice because it is a reusable Azure Monitor resource that defines notification preferences (e.g., email, SMS, webhook, ITSM) and can be associated with multiple alert rules across different subscriptions. This allows the team to create a single notification setup once and reference it from any alert rule, ensuring consistent notification behavior without duplicating configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A Log Analytics workspace with custom tables
Why it's wrong here
A Log Analytics workspace with custom tables is a data store for telemetry, logs, and metrics, enabling KQL queries, analytics, and long-term retention. While an alert rule can query a workspace and trigger based on the results, the workspace is not an endpoint that sends messages to users or external systems. Custom tables simply define the schema for ingested data; delivering a notification from an alert still requires an action group to route the alert to email, SMS, or a webhook.
When this WOULD be correct
An administrator needs to collect custom log data from multiple sources, parse it into structured tables, and run queries for monitoring across subscriptions. Creating a Log Analytics workspace with custom tables would be correct.
- ✓
An action group
Why this is correct
An action group is the correct reusable notification mechanism in Azure Monitor. It centralizes email, SMS, push, voice, webhook, ITSM, and Automation actions so the same set of recipients can be associated with many alert rules across multiple subscriptions. Rather than configuring notification endpoints separately for each alert, an alert rule references an action group by its Azure resource ID, making one definition the single point of management for delivery behavior.
- ✗
A management group
Why it's wrong here
A management group is a container used to organize multiple subscriptions and apply governance policies, role-based access control, and cost controls hierarchically. It is not a target for alert notifications and has no email, SMS, or webhook delivery capability. Alert rules can be defined at management group scope for Azure Policy or some Azure activity log alerts, but the notification actions still must be delivered through an action group; the management group itself never contacts recipients.
When this WOULD be correct
A management group would be correct if the question asked for a way to apply policies or RBAC permissions across multiple subscriptions, or to organize subscriptions for governance and compliance management.
- ✗
A resource lock
Why it's wrong here
A resource lock, such as CanNotDelete or ReadOnly, is a governance control that protects Azure resources from accidental deletion or unintended configuration changes. It does not observe metrics, evaluate alert conditions, or send any type of message when an event occurs. Locks operate at the management plane level and have no integration with Azure Monitor notification pipelines, so they cannot fulfill a notification requirement.
When this WOULD be correct
A resource lock would be the correct answer if the question asked: 'What should an administrator create to prevent accidental deletion of a critical alert rule across multiple subscriptions?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An action groupCorrect answer▾
Why this is correct
An action group is the correct reusable notification mechanism in Azure Monitor. It centralizes email, SMS, push, voice, webhook, ITSM, and Automation actions so the same set of recipients can be associated with many alert rules across multiple subscriptions. Rather than configuring notification endpoints separately for each alert, an alert rule references an action group by its Azure resource ID, making one definition the single point of management for delivery behavior.
✗A Log Analytics workspace with custom tablesWrong answer — click to see why▾
Why this is wrong here
A Log Analytics workspace with custom tables is used for collecting and analyzing log data, not for reusing notification configurations across alert rules in different subscriptions.
★ When this WOULD be the correct answer
An administrator needs to collect custom log data from multiple sources, parse it into structured tables, and run queries for monitoring across subscriptions. Creating a Log Analytics workspace with custom tables would be correct.
Why candidates choose this
Candidates may confuse the data collection and analysis capabilities of Log Analytics workspaces with the notification routing functionality of action groups, especially when dealing with alert rules.
✗A management groupWrong answer — click to see why▾
Why this is wrong here
A management group is a container for managing access, policy, and compliance across multiple subscriptions, not for configuring notification settings for alert rules. It cannot be reused as a notification setup for alert rules.
★ When this WOULD be the correct answer
A management group would be correct if the question asked for a way to apply policies or RBAC permissions across multiple subscriptions, or to organize subscriptions for governance and compliance management.
Why candidates choose this
Candidates may confuse management groups with a way to centrally manage alert notifications across subscriptions, because management groups provide hierarchical organization and policy application, but they do not handle notification routing.
✗A resource lockWrong answer — click to see why▾
Why this is wrong here
A resource lock prevents accidental deletion or modification of resources, but it does not provide a reusable notification setup for alert rules across subscriptions. The question specifically asks for a notification mechanism, not a protection mechanism.
★ When this WOULD be the correct answer
A resource lock would be the correct answer if the question asked: 'What should an administrator create to prevent accidental deletion of a critical alert rule across multiple subscriptions?'
Why candidates choose this
Candidates may confuse resource locks with governance controls that apply broadly, mistakenly thinking they can be used to enforce notification settings across subscriptions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Alert rule
An alert rule is a set of conditions and actions that trigger a notification when a monitored metric or log reaches a predefined threshold.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.