AZ-104 Monitor and Maintain Azure Resources Practice Question
You need to notify the security team whenever anyone deletes a resource group in the subscription. Which alert type should you configure?
⚠ Common exam trap
Watch out — candidates often confuse activity log alerts with log alerts based on guest OS logs, not realizing that resource group deletions are control plane events captured in the Activity Log, not in guest OS event logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An activity log alert
An activity log alert monitors subscription-level events recorded in the Azure Activity Log, including resource group deletion operations. When a user deletes a resource group, the 'Microsoft.Resources/subscriptions/resourceGroups/delete' operation is logged, and an activity log alert can be configured to trigger on that specific operation, sending notifications to the security team.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A metric alert on CPU percentage
Why it's wrong here
A metric alert on CPU percentage monitors performance counters emitted by compute resources, such as a virtual machine's CPU utilization. Resource-group deletion is an administrative action performed through the Azure Resource Manager, not a performance signal, so it cannot be observed in any metric. Even if deleting a VM causes CPU usage to drop, such an indirect indicator is unreliable, misses non-compute deletions, and introduces unnecessary latency, so it fails to satisfy the requirement.
When this WOULD be correct
You need to notify the operations team when a specific virtual machine's CPU usage exceeds 90% for more than 5 minutes to trigger auto-scaling actions.
- ✗
A budget alert
Why it's wrong here
A budget alert watches Azure cost spending and notifies when actual or forecasted costs exceed configured thresholds, typically to prevent overspend. Deleting a resource generally reduces future spending and does not itself incur a charge, so a budget alert has no direct connection to control-plane deletion events. Budget alerts are designed for fiscal control, not operational security monitoring, and cannot detect who deleted a resource or when the deletion occurred.
When this WOULD be correct
A budget alert would be correct if the question asked: 'You need to notify the finance team when subscription spending exceeds $10,000.'
- ✓
An activity log alert
Why this is correct
An activity log alert is purpose-built for Azure control-plane events such as resource-group deletions. The Activity Log records operational events at the subscription level, including the Delete Resource Group operation, and a rule can be configured to fire immediately when that operation occurs. This directly triggers a security-team notification via email, webhook, ITSM, or an action group, making it the correct solution.
- ✗
A log alert based only on guest OS event logs
Why it's wrong here
A log alert based only on guest OS event logs monitors events generated inside a virtual machine's operating system, such as security logons or application errors. A resource-group deletion is an Azure Resource Manager control-plane action that happens externally at the subscription level, never inside the guest OS, so it leaves no entry in guest event logs. Furthermore, such a log source only exists on VMs and cannot capture deletions of networks, storage accounts, or the group itself, making it fundamentally ineffective for this scenario.
When this WOULD be correct
You need to be alerted when a specific application running on a virtual machine crashes, based on events logged in the Windows System event log. A log alert querying the Event table for Application Error events would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An activity log alertCorrect answer▾
Why this is correct
An activity log alert is purpose-built for Azure control-plane events such as resource-group deletions. The Activity Log records operational events at the subscription level, including the Delete Resource Group operation, and a rule can be configured to fire immediately when that operation occurs. This directly triggers a security-team notification via email, webhook, ITSM, or an action group, making it the correct solution.
✗A metric alert on CPU percentageWrong answer — click to see why▾
Why this is wrong here
A metric alert on CPU percentage monitors performance metrics like CPU usage, not resource deletion events. It cannot detect administrative operations such as deleting a resource group.
★ When this WOULD be the correct answer
You need to notify the operations team when a specific virtual machine's CPU usage exceeds 90% for more than 5 minutes to trigger auto-scaling actions.
Why candidates choose this
Candidates may confuse metric alerts with activity log alerts, thinking that any alert type can monitor resource changes, or they may default to common performance monitoring without reading the question carefully.
✗A budget alertWrong answer — click to see why▾
Why this is wrong here
Budget alerts monitor spending against cost thresholds, not resource deletion events. They cannot detect operational actions like deleting resource groups.
★ When this WOULD be the correct answer
A budget alert would be correct if the question asked: 'You need to notify the finance team when subscription spending exceeds $10,000.'
Why candidates choose this
Candidates may confuse budget alerts with activity alerts because both involve monitoring, but budget alerts focus on cost, not resource operations.
✗A log alert based only on guest OS event logsWrong answer — click to see why▾
Why this is wrong here
A log alert based only on guest OS event logs cannot detect Azure resource-level operations like resource group deletion because it monitors events within the virtual machine's operating system, not Azure Resource Manager activities.
★ When this WOULD be the correct answer
You need to be alerted when a specific application running on a virtual machine crashes, based on events logged in the Windows System event log. A log alert querying the Event table for Application Error events would be correct.
Why candidates choose this
Candidates may confuse guest OS logs with Azure activity logs, thinking that OS-level alerts can capture all administrative actions, or they may not understand the scope limitation of guest OS monitoring.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Activity log
An activity log is a record of all operations performed on Azure resources, capturing who did what, when, and where, for auditing and troubleshooting purposes.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.