The answer is an action group. This is the correct component because an action group in Azure Monitor is specifically designed to define the set of notification and automation responses—such as sending an email or invoking a webhook—that execute when a metric alert rule fires. Without linking an action group, the alert rule can only log the event in the Azure portal but cannot perform any external notification or automated action. On the AZ-104 exam, this concept tests your understanding of how to operationalize alerts; a common trap is confusing the alert rule itself with the action group, or thinking that email and webhook settings are configured directly within the rule. Remember that the alert rule is the trigger, while the action group is the response mechanism. A helpful memory tip: think of the action group as your "notification crew"—you link it to the alert so the crew knows to send the email and call the webhook when the alarm sounds.
AZ-104 Monitor and Maintain Azure Resources Practice Question
This AZ-104 practice question tests your understanding of monitor and maintain azure resources. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You already created a metric alert rule. You want the alert to send email and call a webhook when it fires. Which component should you link to the alert rule?
Why wrong: Diagnostic settings export logs and metrics, but they do not define who receives alert notifications or webhook calls.
B
A Log Analytics workspace
Why wrong: A workspace stores and queries data, but it is not the notification target for a metric alert.
C
An action group
An action group is the notification and automation target for Azure alerts. It can send email, trigger webhooks, and start other actions when the alert fires.
D
An Azure Policy initiative
Why wrong: An initiative bundles policies for compliance, but it does not deliver alert notifications or invoke webhooks.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An action group
An action group is the correct component because it defines the notification and automation actions (such as sending an email or invoking a webhook) that are triggered when a metric alert rule fires. In Azure Monitor, alert rules are linked to action groups to execute these responses; without an action group, the alert can only log the event but cannot perform any external notification or automation.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
A diagnostic setting
Why it's wrong here
Diagnostic settings export logs and metrics, but they do not define who receives alert notifications or webhook calls.
✗
A Log Analytics workspace
Why it's wrong here
A workspace stores and queries data, but it is not the notification target for a metric alert.
✓
An action group
Why this is correct
An action group is the notification and automation target for Azure alerts. It can send email, trigger webhooks, and start other actions when the alert fires.
Related concept
Read the scenario before looking for a memorised answer.
✗
An Azure Policy initiative
Why it's wrong here
An initiative bundles policies for compliance, but it does not deliver alert notifications or invoke webhooks.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse diagnostic settings (which export data) with action groups (which define alert responses), leading them to select A instead of C.
Detailed technical explanation
How to think about this question
Under the hood, an action group contains a collection of action receivers (e.g., email, SMS, webhook, ITSM, automation runbook) each with its own endpoint and schema. When a metric alert fires, Azure Monitor evaluates the condition and, if met, invokes all linked action groups asynchronously, sending HTTP POST requests to webhook endpoints with a standardized JSON payload (Azure Monitor Common Alert Schema). A real-world scenario is a production VM alert that triggers an action group to both email the on-call engineer and call a webhook to create a ticket in ServiceNow, ensuring immediate response and tracking.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-104 question in full detail.
Monitor and Maintain Azure Resources — This question tests Monitor and Maintain Azure Resources — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: An action group — An action group is the correct component because it defines the notification and automation actions (such as sending an email or invoking a webhook) that are triggered when a metric alert rule fires. In Azure Monitor, alert rules are linked to action groups to execute these responses; without an action group, the alert can only log the event but cannot perform any external notification or automation.
What should I do if I get this AZ-104 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, a metric alert already exists for VM01, but the on-call team never receives an email when CPU exceeds 80% for 5 minutes. What should you configure to deliver the notification?
easy
A.Create a diagnostic setting on VM01 to export metrics to Log Analytics.
✓ B.Add an action group to the alert rule and configure email delivery.
C.Assign the Reader role to the on-call team so they can view the alert.
D.Create a resource lock on VM01 to prevent accidental changes.
Why B: The alert rule exists, but no notification action is configured. An action group defines how to notify administrators (e.g., email, SMS, webhook). Adding an action group with an email action to the existing alert rule will deliver the email when the CPU threshold is breached.
Variation 2. Based on the exhibit, the alert rule is firing, but the operations team is not receiving any notification. What should you change to make the alert send an email when the condition is met?
medium
A.Increase the evaluation frequency to 15 minutes so Azure sends a summary notification.
✓ B.Attach an action group that includes the required email recipient.
C.Create a diagnostic setting on the virtual machine and send logs to a storage account.
D.Move the virtual machine into a different resource group so the alert can notify the team.
Why B: An alert rule in Azure Monitor requires an action group to define the notification actions (e.g., email, SMS) when the alert fires. Without an action group attached to the alert rule, no notifications are sent, even if the condition is met. Option B correctly identifies that attaching an action group containing the required email recipient will enable email notifications.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.