AZ-104 Monitor and Maintain Azure Resources Practice Question
You need to notify the operations team by email when average CPU utilization on VM-App01 exceeds 80 percent for 15 minutes. Which Azure Monitor components should you configure?
⚠ Common exam trap
It's easy for candidates to confuse metric alerts (for performance data) with activity log alerts (for resource operations), leading candidates to choose an activity log alert when the requirement is about a performance metric like CPU utilization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A metric alert and an action group
A metric alert monitors a specific performance metric (like CPU utilization) and triggers when a threshold is exceeded for a defined duration. An action group defines the notification action (e.g., sending an email) when the alert fires. Together, they meet the requirement to email the operations team when average CPU exceeds 80% for 15 minutes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A metric alert and an action group
Why this is correct
A metric alert continuously evaluates the VM's 'Percentage CPU' metric, which Azure Monitor collects from the host. When the average CPU utilization crosses the configured threshold (e.g., greater than 80%) for the specified window, the alert fires and activates an action group. Action groups are notification services that can send an email to the operations team, as well as SMS, voice, or webhooks. This combination is the standard method for threshold-based performance monitoring and notification.
- ✗
An activity log alert only
Why it's wrong here
Activity log alerts are event-driven rules that trigger only on Azure platform-level changes, such as creating or deleting a VM, starting it, restarting it, or writing a write operation to a resource. They evaluate operational events recorded in the resource's activity log, which does not contain CPU utilization counters or other performance telemetry. An activity log alert by itself cannot continuously sample 'Percentage CPU' and cannot detect a threshold breach of average CPU utilization. Without a metric signal, the operations team would never receive an email under high CPU load.
When this WOULD be correct
An activity log alert would be correct if the question required notification when a VM is deleted, stopped, or its size is changed, or when a security event like a failed login occurs. For example: 'You need to email the team when a virtual machine is deleted from the subscription.'
- ✗
A resource lock and Azure Advisor
Why it's wrong here
A resource lock protects a resource from accidental deletion or unauthorized modifications by enforcing either CanNotDelete or ReadOnly permissions, and has no alerting capability. Azure Advisor analyzes resource configurations and workloads to deliver personalized best-practice recommendations across cost, security, reliability, and performance, but it does not monitor real-time metrics or send threshold-based notifications. Advisor recommendations are published in the portal and can be exported, yet they are not triggered by CPU utilization crossing a specific value. Thus, these two services together cannot email the operations team when average CPU utilization is high.
When this WOULD be correct
You need to prevent accidental deletion of a critical virtual machine and receive recommendations on how to improve its reliability and performance. In that case, you would configure a resource lock on the VM and use Azure Advisor to get recommendations.
- ✗
A budget alert
Why it's wrong here
Budget alerts belong to Azure Cost Management and are designed to warn when actual or forecasted spending exceeds a set monetary amount or percentage of the budget. They evaluate cost data accumulated at subscription, resource group, or management group scope, not performance metrics such as average CPU utilization. Since a budget alert has no access to VM host telemetry, it cannot trigger an email based on CPU load. Therefore, it is an ineffective tool for this operational notification requirement.
When this WOULD be correct
You need to notify the finance team when spending on a subscription exceeds $500 for the month. A budget alert would be the correct component to configure.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A metric alert and an action groupCorrect answer▾
Why this is correct
A metric alert continuously evaluates the VM's 'Percentage CPU' metric, which Azure Monitor collects from the host. When the average CPU utilization crosses the configured threshold (e.g., greater than 80%) for the specified window, the alert fires and activates an action group. Action groups are notification services that can send an email to the operations team, as well as SMS, voice, or webhooks. This combination is the standard method for threshold-based performance monitoring and notification.
✗An activity log alert onlyWrong answer — click to see why▾
Why this is wrong here
An activity log alert monitors changes to Azure resources (e.g., VM creation, deletion), not performance metrics like CPU utilization. It cannot trigger based on a metric threshold exceeding 80% for 15 minutes.
★ When this WOULD be the correct answer
An activity log alert would be correct if the question required notification when a VM is deleted, stopped, or its size is changed, or when a security event like a failed login occurs. For example: 'You need to email the team when a virtual machine is deleted from the subscription.'
Why candidates choose this
Candidates may confuse activity log alerts with metric alerts, thinking any Azure alert can monitor performance metrics, or they may not distinguish between resource-level events and metric-based conditions.
✗A resource lock and Azure AdvisorWrong answer — click to see why▾
Why this is wrong here
A resource lock prevents accidental deletion or modification of resources, and Azure Advisor provides best practice recommendations. Neither component can monitor CPU utilization or send email alerts, so this combination cannot meet the requirement to notify the operations team when CPU exceeds 80% for 15 minutes.
★ When this WOULD be the correct answer
You need to prevent accidental deletion of a critical virtual machine and receive recommendations on how to improve its reliability and performance. In that case, you would configure a resource lock on the VM and use Azure Advisor to get recommendations.
Why candidates choose this
Candidates may confuse Azure Advisor's recommendations with monitoring alerts, or think that a resource lock combined with Advisor can somehow trigger notifications, not realizing that neither component has alerting or email capabilities.
✗A budget alertWrong answer — click to see why▾
Why this is wrong here
A budget alert monitors Azure spending, not CPU utilization. It cannot trigger on performance metrics like average CPU usage exceeding a threshold.
★ When this WOULD be the correct answer
You need to notify the finance team when spending on a subscription exceeds $500 for the month. A budget alert would be the correct component to configure.
Why candidates choose this
Candidates may confuse 'alert' with any notification mechanism, assuming a budget alert can be repurposed for performance monitoring, or they may not understand the distinct scope of budget alerts.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Action group
An Action group is a collection of notification and automation settings that defines how an Azure Monitor alert responds when triggered, such as who gets emailed, which phone numbers get called, or which automated tasks run.
Key term
Metric
A metric is a quantifiable measurement used to assess the performance, health, or status of IT systems, networks, or applications.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.