CCNA Monitor and Maintain Azure Resources Questions

This query does not filter by the specific resource group delete operation (OperationNameValue) and does not exclude the automation account caller. It would trigger alerts for any delete operation on any resource, including non-resource-group deletes and those initiated by rg-cleaner@contoso.com.

The Heartbeat table contains agent health data, not resource group deletion events. The query checks if the automation account computer exists, not if a resource group was deleted.

SecurityEvent tracks Windows security events (like process creation), not Azure resource deletions. The question requires monitoring Azure subscription activity logs for resource group deletions, which SecurityEvent does not capture.

AzureDiagnostics is only populated when diagnostic settings use the AzureDiagnostics table format, not the resource-specific table format. Since the administrator selected resource-specific tables, the data is stored in dedicated tables, not AzureDiagnostics.

Changing replication to GRS does not affect Log Analytics table population; diagnostic logs are sent to Log Analytics independently of replication settings.

Enabling Azure Monitor metrics collection does not affect the population of AzureDiagnostics or resource-specific tables. Metrics are separate from diagnostic logs and do not generate log entries.

Restoring the entire VM into the production resource group would overwrite or conflict with the running VM, causing downtime and potential data loss. The requirement is to restore only one folder without disrupting the running VM.

Restoring the managed disk and attaching it as a second OS disk would not allow selective folder recovery; it would require mounting the disk and manually copying files, which is more complex and not the intended Azure Backup feature for file-level recovery.

Creating a new Recovery Services vault and re-protecting the VM does not restore the deleted folder; it only enables future backups. The existing backup data remains in the original vault and is not accessible via a new vault.

The query filters for 'Succeeded' status instead of 'Failed', so it counts successful delete operations, not failed ones as required.

This query queries the SecurityEvent table for EventID 4670 (permissions change), not the AzureActivity table, and does not filter for storage account delete operations or failures.

This option does not filter by ActivityStatusValue == 'Failed', so it counts all delete operations (including successful ones) instead of only failed operations as required.

Azure Monitor metric chart provides performance metrics and alerts, but does not show backup job outcomes or allow drill-down into failed job details for a specific VM.

The Azure Activity Log tracks control-plane operations (e.g., create/delete vaults) and does not include backup job outcomes like success/failure for individual VMs. It cannot provide a consolidated view of job status across multiple vaults.

Resource Health provides health status of Azure resources (e.g., VM, storage) but does not show backup job outcomes or allow drilling into failed job details across multiple Recovery Services vaults.

RA-GRS provides geo-redundant storage for durability, not searchable log data retention or query capabilities. The requirement is for 30 days of searchable logs and workbook/alert queries, which requires a Log Analytics workspace.

Enabling a CanNotDelete lock prevents accidental deletion of the storage account but does not affect log data retention, searchability, or query capabilities in workbooks and alerts.

Configuring a private endpoint for the storage account provides network isolation by enabling private connectivity, but it does not affect log data retention or query capabilities. The requirement is for searchable log data and queries in workbooks/alerts, which requires a Log Analytics workspace, not a private endpoint.

Azure Backup policies for virtual machines only include backup schedule and retention period settings; virtual network peering is a networking configuration unrelated to backup policies.

Network security group rules are not configurable within an Azure Backup policy; they control inbound/outbound traffic to the VM, not backup settings.

Public IP allocation is a setting for network interfaces, not for Azure Backup policies. Backup policies only control backup schedule and retention, not IP configuration.

Azure Advisor provides personalized recommendations for best practices in cost, security, reliability, and performance, but it does not offer real-time health status or incident information to differentiate between platform-wide and VM-specific issues.

Backup center is used for managing and monitoring backups, not for diagnosing live VM issues or platform problems. It does not provide real-time health status of Azure services or individual resources.

Log Analytics workspace is used for collecting and analyzing telemetry data, not for determining whether a VM issue is caused by a platform problem or a VM-specific problem. It does not provide real-time health status of Azure services or individual resources.

Sending all VM diagnostic logs to Log Analytics incurs significant data ingestion costs, which contradicts the goal of keeping telemetry ingestion costs low. Log search alerts also require continuous log ingestion, increasing expenses compared to metric alerts that use pre-aggregated data.

A Recovery Services vault backup policy with a short retention period does not provide alerts for VM CPU and storage capacity thresholds; it only manages backup retention, not real-time performance monitoring.

Azure Policy audits compliance but does not generate real-time alerts for CPU or storage thresholds; it only evaluates and reports configuration drift, not performance metrics.

Storage capacity alerts do not indicate platform-level health; a regional platform issue may not affect capacity, and capacity reduction is not a reliable indicator of service unavailability.

The question explicitly states the team does not want to depend on a Log Analytics query or any polling script. A log alert on AzureDiagnostics requires a Log Analytics workspace and query, violating this constraint.

An activity log alert on every write operation would notify on each write, not on platform-level health issues. It does not detect regional platform unavailability and would generate excessive noise.

Network security group rules control inbound/outbound traffic to Azure resources, not backup scheduling or retention. Azure Backup policies only include backup schedule and retention rules.

Private DNS zone records are used for custom domain name resolution within a virtual network, not for configuring backup retention or scheduling. Azure Backup policies only involve backup schedule and retention rules.

Availability set placement is a VM high-availability configuration, not a backup policy setting. Backup policies define when backups occur and how long they are retained, not VM placement.

The activity log does not include storage resource logs (e.g., storage read/write logs) or storage metrics; it only contains control-plane events like creating a storage account. The requirement to search application logs and monitor storage metrics necessitates resource logs and AllMetrics, which are only available via diagnostic settings.

An action group is used to define actions (e.g., email, SMS) triggered by alerts, not to archive or forward storage events to Log Analytics or for long-term retention. It does not collect logs or metrics.

Metric alerts are for notifying on threshold breaches, not for retention or sending logs to Log Analytics; they cannot retain logs for 30 days or archive for one year.

Azure Policy assignment enforces compliance rules on resources (e.g., tagging, SKU restrictions) and does not send notifications based on performance metrics like CPU percentage.

A Recovery Services vault is used for Azure Backup and Azure Site Recovery, not for monitoring or alerting. It cannot send email or SMS notifications based on CPU metrics.

A Log Analytics workspace is used for collecting and analyzing log data, not for sending email or SMS notifications based on CPU metrics. The notification action requires an action group, not a Log Analytics workspace.

AzureActivity does not contain heartbeat data; heartbeats are logged in the Heartbeat table. This query also counts events by resource group instead of identifying VMs with no recent heartbeat.

The Perf table contains performance counters like '% Processor Time', not heartbeat data. This query calculates average CPU usage per computer, which does not identify VMs that have stopped sending heartbeats.

SecurityEvent with EventID 4624 logs successful user logons, not VM heartbeats. It cannot determine if a VM has stopped sending heartbeats.

A Recovery Services vault is used for backup and disaster recovery, not for collecting and querying performance counters and event logs with Kusto Query Language.

Azure Network Watcher provides network monitoring and diagnostics (e.g., packet capture, NSG flow logs), but it does not collect performance counters or event logs, nor does it support querying data with Kusto Query Language (KQL).

A load balancer distributes network traffic across virtual machines; it does not collect performance counters or event logs, nor does it support querying data with Kusto Query Language.

Azure Backup vault names are metadata, not logs. They cannot be sent to Log Analytics for querying platform-generated events or resource changes.

Virtual network address spaces are configuration settings, not logs. They cannot be sent to Log Analytics for querying as log data; only activity logs and resource diagnostic logs are log types that can be collected.

Managed disk size settings are configuration properties, not logs. They cannot be sent to Log Analytics as a log type; only activity logs and resource diagnostic logs can be collected for querying.

The 'extend' operator adds a new calculated column to the result set, but it does not filter rows or remove existing columns. The question requires narrowing to only failed backup jobs (filtering) and showing only needed columns (projection), which is achieved by 'where' and 'project', not 'extend'.

The 'join' operator is used to combine rows from two tables based on a matching key, not to filter rows or select columns. The question asks for narrowing results to only failed backup jobs (filtering) and showing only needed columns (projection), which require 'where' and 'project'.

The 'summarize' operator aggregates data into groups, but the question requires filtering rows (failed jobs) and selecting columns, not aggregation. It does not filter or project columns.

Azure Policy enforces compliance rules and governance, but it does not provide recommendations for cost, performance, or security optimization. Azure Advisor is the service specifically designed to deliver personalized best practice recommendations across these areas.

Azure Backup is a service for backing up data and workloads, not for providing recommendations to reduce cost, improve performance, or strengthen security across subscriptions.

Virtual network peering connects Azure virtual networks for traffic routing, but it does not provide recommendations for cost, performance, or security across subscriptions.

Joining to AzureActivity is unnecessary for identifying VMs with heartbeats older than 20 minutes; the Heartbeat table alone provides the required timestamp data.

Filtering where TimeGenerated is older than 20 minutes before summarizing would exclude recent heartbeats, making it impossible to identify the most recent heartbeat per VM. The correct approach is to summarize first to get the latest timestamp per computer, then filter on that result.

The Perf table stores performance counters (e.g., CPU, memory), not heartbeat timestamps. Heartbeat data is stored in the Heartbeat table, so using Perf would not yield the required heartbeat information.

A network security group (NSG) filters network traffic to/from Azure resources, but it does not collect or route platform logs to a Log Analytics workspace. Diagnostic settings on the resource (like the storage account) are required to send logs to the workspace.

A Recovery Services vault is used for backup and disaster recovery (Azure Backup, Site Recovery), not for collecting platform logs to a Log Analytics workspace. Diagnostic settings and a Log Analytics workspace are the required components.

Availability zone assignment is a high-availability feature for Azure resources, not a component for collecting platform logs into a Log Analytics workspace. Diagnostic settings and a Log Analytics workspace are the required items.

A Recovery Services vault is used for backup and disaster recovery (Azure Backup and Site Recovery), not for collecting guest OS performance counters and event logs into a queryable platform.

An Azure Policy initiative is used to enforce organizational policies and compliance rules across resources, not to collect and query guest OS performance counters and event logs.

A route table controls network traffic routing between subnets and does not collect or store guest OS performance counters or event logs.

An activity log alert monitors changes to Azure resources (e.g., VM creation, deletion), not performance metrics like CPU utilization. It cannot trigger based on a metric threshold exceeding 80% for 15 minutes.

A resource lock prevents accidental deletion or modification of resources, and Azure Advisor provides best practice recommendations. Neither component can monitor CPU utilization or send email alerts, so this combination cannot meet the requirement to notify the operations team when CPU exceeds 80% for 15 minutes.

A budget alert monitors Azure spending, not CPU utilization. It cannot trigger on performance metrics like average CPU usage exceeding a threshold.

Recreating the VM in another region restores the entire VM, not a single file, and is unnecessary for recovering one deleted document. It also incurs higher cost and complexity.

Changing the VM size does not recover deleted files; it modifies compute resources, which is irrelevant to file-level restoration from a backup.

Disabling the backup policy stops future backups but does not recover the deleted file. The question requires recovering a single file, not altering backup settings.

A Log Analytics workspace is for collecting and analyzing log data, not for creating backups of Azure virtual machines. Backup functionality is provided by Azure Backup, not Log Analytics.

Log Analytics workspace is a monitoring and log management service, not an identity and access management tool. It does not assign permissions to Azure resources at any scope; that is the role of Azure RBAC (Role-Based Access Control) applied to management groups, subscriptions, resource groups, or individual resources.

A Log Analytics workspace is used for collecting and querying log data, not for blocking resource creation. Azure Policy, not Log Analytics, enforces rules to block non-compliant resource creation.

A log query alert runs on a schedule (e.g., every 5 minutes) and evaluates historical data, not continuously. The requirement for continuous evaluation (real-time) is better met by a metric alert, which monitors metrics in near real-time.

This option does not meet the requirement for continuous evaluation of CPU metrics; it relies on logs sent to a storage account, which introduces latency and does not support real-time metric alerting. Additionally, it lacks a mechanism to suppress notifications outside business hours.

Option D is wrong because it suggests pausing the workload outside business hours, which is not required by the question. The requirement is to suppress email notifications, not to alter VM operation. Additionally, using a VM extension to pause workloads is an overly complex and inappropriate solution for notification suppression.

A diagnostic setting controls collection and routing of resource logs and metrics to destinations like Log Analytics or storage, but it does not define alerting actions (email/SMS). The question requires notification actions, which are configured in an action group, not a diagnostic setting.

Workbooks are for creating interactive reports and visualizations from Azure Monitor data, not for configuring notifications. They cannot send alerts to email or SMS.

Service health alerts notify about Azure service issues, outages, or planned maintenance, not about VM performance metrics like Percentage CPU. This question requires monitoring VM-level metrics, not Azure platform health.

Restoring the VM as a new virtual machine and deleting the existing one would change the VM's identity, NIC, and data disk attachments, violating the requirement to keep the VM in place with its NIC and data disks.

Azure Monitor is a monitoring and diagnostics service, not a backup or restore tool. It cannot roll back deployments or repair corrupted OS disks.

Enabling a diagnostic setting on the VM does not repair a corrupted OS disk; it only collects logs and metrics. It cannot restore or fix disk corruption.

Archive tier is a storage tier for long-term retention of backup data, not a feature to recover accidentally deleted backup items within the retention window.

Availability zones protect against datacenter-level failures by distributing resources across zones, but they do not provide recovery of accidentally deleted backup items within a Recovery Services vault.

Private endpoints provide secure connectivity to the Recovery Services vault over a private IP address, but they do not offer any protection or recovery for accidentally deleted backup items.

The requirement is for 30-day recovery of daily backups, not weekly. Increasing weekly retention to 30 weeks would keep weekly backups for 30 weeks, but daily backups would still only be retained for 7 days, failing the 30-day daily recovery goal.

Changing the backup schedule to every 30 days would only create one backup per month, failing the requirement for daily backups with 30-day recovery.

Enabling archive tier moves older backups to cold storage but does not change retention durations; the policy still needs daily retention set to 30 days to meet the 30-day recovery requirement.

The question asks for restoring individual files or folders, not the entire VM. Option A describes recreating the entire VM, which is excessive and not the required restore action.

The question asks for a restore option, but 'Backup policy' is a configuration setting that defines backup schedules and retention, not a restore action. It does not perform any restoration of data.

In the context of restoring a deleted file from a VM backup, the 'Recovery point' is not an action; it is a point in time from which you restore. The correct action is 'File recovery', which allows mounting the backup to retrieve specific files.

A Log Analytics workspace is used for collecting and analyzing diagnostic logs and metrics, not for sending email or SMS notifications. The question specifically asks about sending notifications, which requires an action group.

The question asks about sending email and SMS notifications, which requires an action group. A backup recovery point is used for restoring virtual machine data, not for configuring notifications.

A private endpoint is used to securely connect to Azure services over a private IP address, not to send email or SMS notifications. It does not provide notification capabilities.

Restoring the entire VM from a recovery point is much slower than file-level recovery and would cause downtime, which contradicts the requirement to keep the VM running and restore only the deleted file as quickly as possible.

Azure Site Recovery is designed for disaster recovery and failover, not for granular file-level restore from backup. Failing over the VM would cause downtime and is much slower than using File Recovery.

Creating a snapshot of the VM disk and restoring the spreadsheet from it is slower and more complex than using File Recovery, as it requires stopping the VM or detaching the disk, and does not allow direct file-level restore from Azure Backup snapshots.

The question states that a metric alert already exists, but no email is sent. The issue is with the alert's notification action, not with data collection. Exporting metrics to Log Analytics does not configure email delivery for the alert.

Assigning the Reader role allows viewing alerts but does not enable email notifications; the alert rule lacks an action group to send emails.

A resource lock prevents deletion or modification of VM01, but does not affect alert notifications. The issue is that no email is sent when the alert fires, which requires an action group, not a lock.

Backup failures due to VM agent not ready indicate an issue with the agent itself, not the availability zone. Azure Backup supports all availability zones, so zone placement does not cause immediate backup failures.

Outbound connectivity via a public IP is not required for Azure Backup to function; the VM agent communicates internally with Azure storage endpoints, and backup can work through a private endpoint or service endpoint.

Adding a VM to a load balancer backend pool is unrelated to backup failures caused by the VM agent not being ready. Backup operations depend on the VM agent and extensions, not load balancing configuration.

A management group is used for organizing and managing access, policies, and compliance across multiple Azure subscriptions, not for sending notifications about application availability.

A private endpoint is used to securely connect to Azure services over a private network, not to send notifications for application unavailability. It does not trigger alerts or integrate with action groups.

Azure Backup soft delete retains deleted backup data for a grace period (default 14 days), not permanently deleting backups immediately.

Azure Backup soft delete does not change a VM's availability zone; it only retains deleted backup data for a grace period to allow recovery.

Azure Backup soft delete applies to backup data, not to Azure Policy assignments. It is a feature of Azure Backup that protects against accidental deletion of backup data, not a policy-level setting.

This option is wrong because the question requires a metric-based alert on CPU percentage, which is a platform metric, not an Activity log event. Log Analytics query alerts on the Activity log cannot monitor performance metrics like CPU usage.

Exporting VM diagnostics to a storage account and having operators review files after incidents does not provide real-time alerting or automated notifications; it requires manual review and cannot trigger immediate email/SMS alerts.

Resource locks prevent accidental deletion or modification of resources but do not monitor CPU usage or trigger alerts. Azure Policy enforces compliance rules but cannot send notifications about performance metrics like CPU spikes.

This query filters heartbeats older than 20 minutes first, then summarizes by computer. It returns computers that have any heartbeat older than 20 minutes, even if they also have a recent heartbeat, so it does not correctly identify computers whose most recent heartbeat is older than 20 minutes.

This query counts heartbeats per computer and filters those with fewer than 20 heartbeats, not those whose most recent heartbeat is older than 20 minutes. It does not consider the time of the last heartbeat.

This query filters heartbeats from the last 20 minutes and then summarizes the latest heartbeat per computer, which returns computers with heartbeats within the last 20 minutes, not those whose most recent heartbeat is older than 20 minutes.

A metric alert on CPU monitors performance metrics, not resource group deletion events. It cannot detect administrative operations like deletions.

A log alert on a custom KQL query in a workspace only monitors log data ingested into a Log Analytics workspace, not resource-level operations like resource group deletion. The question requires an alert on the delete action itself, which is captured by activity logs, not workspace logs.

Backup alerts from a Recovery Services vault notify about backup failures or issues, not about resource group deletion events.

The VM restore option overwrites the entire VM, which is not suitable for restoring a single file without affecting other data or the running state.

Increasing VM size and redeploying the workload does not restore a deleted file; it only changes the VM's hardware resources and re-deploys the application, which does not recover the deleted file from a backup.

Diagnostic settings capture performance and log data, not file-level restore points. They cannot be used to recover a specific deleted file from a VM.

The question requires an alert on resource group deletions, not performance metrics. A metric alert on CPU percentage cannot detect resource group deletion events.

Enabling a diagnostic setting on the resource group object does not create alerts; it only streams logs to a destination. The question requires an alert on resource group deletions, which is not achieved by diagnostic settings alone.

Azure Policy deny assignment prevents resource creation or modification, but it does not generate alerts when deletions occur. The question requires an alert to fire on resource group deletion, not a preventive control.

A resource lock prevents accidental deletion or modification of resources, and Azure Advisor provides best practice recommendations, but neither can trigger an email based on CPU usage metrics.

An activity log alert only monitors changes to Azure resources (e.g., creation, deletion) or service health events, not performance metrics like CPU usage. It cannot trigger based on metric thresholds.

A budget alert monitors cost thresholds, not performance metrics like CPU usage. It cannot trigger an email based on average CPU exceeding 85% for 10 minutes.

This query fires when the last heartbeat is more recent than 15 minutes ago, i.e., when VM01 has sent a heartbeat within the last 15 minutes, which is the opposite of the desired condition (no heartbeat in 15 minutes).

This query checks for heartbeats in the last 15 minutes and counts them, but it does not identify if VM01 has missed a heartbeat; it would fire even if VM01 has heartbeats within the window, as long as count is >0.

This query counts heartbeats per 15-minute bin but does not check if the latest heartbeat is older than 15 minutes; it could return a count even if VM01 sent a heartbeat within the last 15 minutes, failing to detect absence.

File-level recovery from Azure Backup does not require the storage account access key; the recovery point is mounted via the portal using vault credentials and the selected recovery point, not by directly accessing the storage account.

Assigning a public IP address to the VM is not required for Azure Backup file-level recovery; the recovery point is mounted via a script that uses the vault credentials and does not require direct network access to the VM.

Azure Backup file-level recovery does not require an Azure AD application secret. The process involves downloading vault credentials and selecting a recovery point, then mounting the recovery point using a script that runs on the VM, which does not need Azure AD authentication.

A diagnostic setting sends metrics to Log Analytics but does not suppress notifications; the alert would still fire 24/7, and email notifications would continue outside business hours.

Lowering the alert threshold reduces the number of alerts but does not restrict notifications to business hours; the alert would still fire and notify outside those hours if the threshold is crossed.

Autoscale profiles adjust VM capacity based on load, not send email notifications or suppress them. The requirement is to control notification timing, not scaling behavior.

The backup failure message explicitly indicates the guest agent is not ready, which points to an issue with the Azure VM agent inside the guest OS, not the storage redundancy type of the Recovery Services vault.

The immediate failure with 'guest agent not ready' indicates a problem with the Azure VM agent inside the guest OS, not network connectivity. A private endpoint is used for secure access to the vault, but it does not affect the guest agent's readiness.

A resource lock prevents deletion or modification of the VM, but it does not affect the guest agent's ability to communicate with Azure Backup. The immediate failure with 'guest agent not ready' indicates an agent issue, not a lock.

Guest-level diagnostics capture OS-level events inside the VM, not Azure resource deletion events, which are recorded in the Azure Activity Log at the subscription scope.

NSG flow logs capture IP traffic data (source/destination, ports, protocols), not Azure resource deletion events. Resource deletions are recorded in the Azure Activity Log, not in network flow logs.

VM backups and restore points capture VM data, not Azure resource deletion events (which are recorded in the Activity Log). They cannot provide a searchable history of who deleted resources and when.

Restoring the entire VM to a new deployment is disruptive and time-consuming, and it does not keep the original VM online during recovery. The requirement is to recover a single file while the VM stays online, which is not achieved by this method.

Azure Site Recovery is a disaster recovery solution for replicating VMs to a secondary region, not for recovering individual files from Azure Backup. It requires failover to a recovery region, which would cause downtime and is not designed for granular file recovery from backup points.

Creating a new backup policy with shorter retention and running the next scheduled backup does not recover the missing file; it only changes future backup behavior. The question requires immediate recovery of a specific file from an existing backup, not altering backup policies.

Network security groups (NSGs) control inbound/outbound traffic to VMs and do not log or report backup job status. Backup status is tracked in the Recovery Services vault, not in NSG metrics or logs.

An availability set is a logical grouping of VMs to provide high availability, not a monitoring or logging resource. Backup status is not tracked or displayed in an availability set.

The subscription activity log records administrative operations on resources, not backup job statuses. Backup job details are stored in the Recovery Services vault, not in the activity log.

Azure Policy enforces compliance rules and governance, but it does not analyze resource utilization or provide cost/security recommendations. The question specifically asks for identifying underutilized VMs and recommending cost/security improvements, which is Azure Advisor's function.

Azure Backup is a service for backing up data and workloads, not for identifying underutilized resources or providing cost and security recommendations.

Virtual network peering connects virtual networks for traffic routing, but it does not analyze VM utilization or provide cost/security recommendations.

Metric alert rules monitor performance metrics (e.g., latency, throughput) and trigger actions, but they do not collect or send resource logs to Log Analytics. Resource logs require a diagnostic setting to be configured.

A resource lock prevents accidental deletion or modification of the storage account, but it does not collect or send resource logs to Log Analytics for investigating read and write failures.

Moving the storage account to a different subscription does not automatically send resource logs to Log Analytics; you still need to configure a diagnostic setting to stream logs to the workspace.

The alert rule already uses a metric condition (CPU > 85% for 10 minutes), so sending metrics to Log Analytics is unnecessary for notification. The issue is that no action group is attached to the alert to send email/SMS.

A resource lock prevents accidental deletion or modification of the VM, but it does not affect alert notifications. The issue is that no one receives notifications, which requires an action group, not a lock.

Increasing daily retention to 365 days would keep every daily backup for a year, not just one per week. The requirement is to keep one weekly backup for 52 weeks, not all daily backups.

Soft delete retains deleted backup data for a specified duration, but it does not create additional weekly recovery points. The requirement is to keep one backup per week for 52 weeks, which requires a retention rule, not soft delete.

Creating a metric alert does not change the backup retention policy; it only notifies when backups are older than seven days, which does not meet the compliance requirement of retaining one weekly backup for 52 weeks.

A budget alert monitors cost thresholds, not CPU performance, and a private DNS zone resolves names in a virtual network, not alerting. These components do not address CPU metric alerts or email notifications.

A Recovery Services vault is used for backup and disaster recovery, not for monitoring CPU metrics. A route table controls network traffic routing and has no role in alerting. Neither component can generate or deliver email alerts based on CPU thresholds.

Activity log export sends logs to a storage account or event hub, not directly to email administrators. A lock prevents accidental deletion or modification of resources but does not trigger email alerts. Neither component can create an email alert for CPU threshold.

Enabling full VM Insights collects many performance counters beyond just CPU and disk free space, significantly increasing telemetry ingestion costs, which contradicts the goal of lowest cost.

Streaming all syslog and event logs to a workspace incurs significant ingestion costs, which contradicts the goal of lowest telemetry ingestion cost. The question only requires monitoring CPU and disk free space, not all logs.

Azure Resource Health does not monitor guest OS metrics like disk free space; it only tracks Azure resource-level health (e.g., VM availability, host issues). It cannot measure OS-level performance counters.

A storage account only stores logs as blobs, which cannot be queried directly with KQL or analyzed alongside other resource logs in a unified query environment.

An action group is used to send notifications (e.g., email, SMS) or trigger automated actions based on alerts, not to store or query logs. It cannot serve as a destination for diagnostic settings to collect logs for querying.

A management group is a container for managing access, policies, and compliance across multiple subscriptions, not a destination for diagnostic logs. It cannot store or query log data.

Azure Backup provides data protection and recovery from accidental deletion or corruption, but it does not provide automatic failover or continuous replication to another region. It requires manual restore and does not ensure immediate service continuity during a regional outage.

Azure Backup provides data protection and recovery from accidental deletion or corruption, but it does not provide automatic failover or continuous replication to another region. It cannot ensure application availability during a regional outage.

Enabling diagnostic settings on a VM only collects logs and metrics; it does not provide any replication or failover capability to another region, so it cannot ensure app availability during a regional outage.

The question states they do not want to ingest extra performance data just to watch CPU, and a log query alert requires CPU samples to be sent to Log Analytics, which would incur additional cost and data ingestion.

Autoscale rules are designed to automatically adjust the number of instances based on metrics, not to send alerts. Their notification settings are for scaling events, not for alerting on sustained high CPU, and they lack the flexibility of action groups (e.g., email and webhook).

This option requires writing CPU data to storage and later reviewing it, which does not provide real-time alerting with email and webhook notification as required by the question.

Editing the existing policy to 30-day retention would apply the change to all 40 VMs, not just the finance VM, violating the requirement to keep other VMs on the 7-day policy.

Moving a VM to a different resource group does not change its backup policy or retention settings; backup policies are assigned per vault, not per resource group.

A resource lock prevents deletion or modification of the VM or its backup data, but it does not extend the retention period of recovery points. The backup policy still deletes points after 7 days regardless of the lock.

Resource locks prevent accidental deletion or modification but do not collect or centralize logs; they cannot enable querying Windows event logs and Azure resource logs in a single workspace.

Availability sets are used for VM high availability, not for aggregating logs from different Azure resources into a single Log Analytics workspace.

Disabling all diagnostic collection would prevent sending Azure resource logs from the storage account and Windows event logs from the VM to the Log Analytics workspace, making incident investigation impossible.

Azure Policy is used to enforce organizational standards and assess compliance, not to provide recommendations on underutilized resources, security improvements, or cost savings.

Network Watcher provides network monitoring and diagnostics (e.g., packet capture, topology), not recommendations on underutilized VMs, security improvements, or cost savings.

Azure Backup is a service for backing up data and workloads, not for providing recommendations on underutilized resources, security improvements, or cost savings.

Increasing evaluation frequency does not add email notification capability; the alert rule lacks an action group, which is required to send emails.

Creating a diagnostic setting on the virtual machine and sending logs to a storage account does not configure notifications; it only archives or streams logs. The alert rule already fires, but notifications require an action group with email recipients.

Moving the virtual machine to a different resource group does not affect alert notifications; action groups are independent of resource group membership and must be explicitly attached to the alert rule.