AZ-104 Monitor and Maintain Azure Resources Practice Question
Exhibit
Alert rule: Name: CPU-Alert-VM01 Scope: /subscriptions/00000000-0000-0000-0000-000000000001/resourceGroups/RG-Prod/providers/Microsoft.Compute/virtualMachines/vm01 Condition: Percentage CPU is greater than 80 for 5 minutes Status: Enabled Action groups: None
Based on the exhibit, what should the administrator configure so the alert sends email and SMS when CPU stays above the threshold?
⚠ Common exam trap
Many exam-takers confuse diagnostic settings (which export data) with action groups (which deliver notifications), or they mistakenly think boot diagnostics or resource locks can influence alert delivery or CPU behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Associate an Azure Monitor action group with the alert rule.
An Azure Monitor action group defines the notification channels (e.g., email, SMS) and actions to trigger when an alert fires. Associating an action group with the alert rule enables the administrator to send both email and SMS when the CPU threshold is breached. Without an action group, the alert rule can only log the condition but cannot deliver notifications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a diagnostic setting on the virtual machine and send metrics to a Log Analytics workspace.
Why it's wrong here
Creating a diagnostic setting to stream VM metrics to a Log Analytics workspace is useful for long-term retention, cross-correlation with logs, and custom log queries via Kusto, but it does not itself generate email, SMS, or push notifications. Alerts on Log Analytics data require a separate log search alert rule, and that rule would still need an action group to notify anyone. Exporting metrics to a workspace only helps with analysis and historical troubleshooting; it does not satisfy the requirement to proactively notify the administrator when the CPU threshold is exceeded.
When this WOULD be correct
If the question asked how to route VM performance metrics to a centralized workspace for long-term analysis and querying, creating a diagnostic setting to send metrics to a Log Analytics workspace would be correct.
- ✓
Associate an Azure Monitor action group with the alert rule.
Why this is correct
To deliver notifications when a metric alert fires, the alert rule must reference an Azure Monitor action group. The action group defines the notification channels (email, SMS, push, webhook, ITSM, etc.) and can also perform automated actions such as an Azure Function or Automation runbook. Without associating an action group, the alert rule will still evaluate the CPU metric and change state, but no one will be notified and no automated response will occur, so this configuration is mandatory for alert-driven communication.
- ✗
Enable boot diagnostics on the virtual machine so the CPU threshold can be reported.
Why it's wrong here
Boot diagnostics on a virtual machine captures serial console output and screenshots of the boot process, which are useful for troubleshooting startup failures, kernel panics, or OS-level boot issues. It does not collect performance counters such as CPU percentage, nor does it trigger operational alerts when a metric threshold is crossed. The Azure Monitor metric pipeline collects CPU utilization independently; boot diagnostics is irrelevant to metric alerting and cannot report or transmit CPU threshold data.
When this WOULD be correct
An administrator needs to troubleshoot a VM that fails to boot and wants to capture serial console output and screenshots to analyze the boot process. Enabling boot diagnostics would be the correct action.
- ✗
Apply a resource lock to the virtual machine to prevent the CPU from increasing further.
Why it's wrong here
A resource lock on a virtual machine prevents accidental deletion or modification of the resource by blocking management plane operations (e.g., Delete or Write) at the lock scope. It has no effect on the data plane or on runtime performance, so it cannot limit CPU usage, throttle the workload, or reduce metric values. CPU utilization is governed by the guest OS processes and virtual machine sizing; a lock merely protects the resource from administrative changes and does not monitor or send alerts.
When this WOULD be correct
An administrator wants to prevent accidental deletion of a critical production VM that hosts a database. Applying a resource lock (e.g., CanNotDelete) would be the correct action to protect the VM from being removed.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Associate an Azure Monitor action group with the alert rule.Correct answer▾
Why this is correct
To deliver notifications when a metric alert fires, the alert rule must reference an Azure Monitor action group. The action group defines the notification channels (email, SMS, push, webhook, ITSM, etc.) and can also perform automated actions such as an Azure Function or Automation runbook. Without associating an action group, the alert rule will still evaluate the CPU metric and change state, but no one will be notified and no automated response will occur, so this configuration is mandatory for alert-driven communication.
✗Create a diagnostic setting on the virtual machine and send metrics to a Log Analytics workspace.Wrong answer — click to see why▾
Why this is wrong here
Diagnostic settings send metrics to Log Analytics for analysis, but they do not directly enable email or SMS notifications. The alert rule needs an action group to define notification actions.
★ When this WOULD be the correct answer
If the question asked how to route VM performance metrics to a centralized workspace for long-term analysis and querying, creating a diagnostic setting to send metrics to a Log Analytics workspace would be correct.
Why candidates choose this
Candidates may confuse diagnostic settings with alert actions, thinking that sending metrics to Log Analytics automatically enables notifications, or they may overcomplicate the solution by involving Log Analytics when a simple action group suffices.
✗Enable boot diagnostics on the virtual machine so the CPU threshold can be reported.Wrong answer — click to see why▾
Why this is wrong here
Boot diagnostics capture serial logs and screenshots for troubleshooting boot failures, not CPU performance metrics. They cannot be used to trigger alerts based on CPU threshold.
★ When this WOULD be the correct answer
An administrator needs to troubleshoot a VM that fails to boot and wants to capture serial console output and screenshots to analyze the boot process. Enabling boot diagnostics would be the correct action.
Why candidates choose this
Candidates may confuse 'diagnostics' with performance monitoring, assuming boot diagnostics can report CPU usage, or they might think enabling any diagnostic setting helps with alerting.
✗Apply a resource lock to the virtual machine to prevent the CPU from increasing further.Wrong answer — click to see why▾
Why this is wrong here
Applying a resource lock prevents accidental deletion or modification of the VM, but does not affect CPU usage or alerting. The question asks about sending email and SMS when CPU stays above threshold, which requires an action group, not a lock.
★ When this WOULD be the correct answer
An administrator wants to prevent accidental deletion of a critical production VM that hosts a database. Applying a resource lock (e.g., CanNotDelete) would be the correct action to protect the VM from being removed.
Why candidates choose this
Candidates may confuse resource locks with a method to 'lock down' or control resource behavior, mistakenly thinking it can limit CPU usage or trigger alerts.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Monitor
Azure Monitor is a cloud service that collects, analyzes, and acts on telemetry data from your Azure and on-premises resources to help you understand performance and availability.
Key term
Action group
An Action group is a collection of notification and automation settings that defines how an Azure Monitor alert responds when triggered, such as who gets emailed, which phone numbers get called, or which automated tasks run.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.