AZ-104 Monitor and Maintain Azure Resources Practice Question
Several Azure Monitor alerts across different subscriptions must notify the same on-call group by email, SMS, and webhook whenever they fire. The operations team wants to define the notification target once and reuse it from future metric alerts, log alerts, and activity log alerts. What should be created?
⚠ Common exam trap
A common mix-up: candidates confuse alert rules (which define the condition to trigger) with action groups (which define the notification destination), leading them to select a metric alert or diagnostic setting instead of the reusable notification container.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An action group that can be attached to multiple Azure Monitor alert rules.
An action group in Azure Monitor is the correct solution because it defines a reusable collection of notification channels (email, SMS, webhook) that can be attached to multiple alert rules across different subscriptions. This allows the operations team to define the on-call group notification target once and reuse it for metric alerts, log alerts, and activity log alerts, ensuring consistent notification behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An action group that can be attached to multiple Azure Monitor alert rules.
Why this is correct
An action group is the reusable notification target in Azure Monitor. You define the recipients and actions once, then attach that action group to any metric, log, or activity log alert that should notify the same people. This separates alert detection from alert delivery, which keeps the design consistent across subscriptions and reduces repeated configuration. It is the right feature when the notification method must be shared broadly.
- ✗
A metric alert with the same threshold applied to every resource that needs notification.
Why it's wrong here
A metric alert with the same threshold applied to multiple resources creates detection rules that evaluate specific metric conditions, but the alert rule itself is not a notification container. To notify users, a metric alert must reference an action group; the rule only defines the condition that triggers the action. Additionally, metric alerts are scoped to specific resources or a resource scope, so you would still need to link the same action group to each alert rule to achieve consistent delivery — the threshold does not, by itself, define who gets alerted. This approach also fails to cover other alert types like log alerts or activity log alerts, which require the same shared action group configuration.
When this WOULD be correct
A metric alert would be correct if the question asked for a rule that fires when a specific metric exceeds a threshold, and the notification method is defined separately (e.g., via an action group).
- ✗
A diagnostic setting on each resource so the contact list is stored with the logs.
Why it's wrong here
A diagnostic setting on each resource configures the export of platform logs and metrics to destinations such as a Log Analytics workspace, storage account, or Event Hub for retention and analysis. It neither defines nor stores notification recipients — diagnostic settings are a telemetry pipeline, not an alert delivery mechanism. Even if every resource had a diagnostic setting configured, no email, SMS, or webhook would be triggered because Azure Monitor requires an action group to execute those actions, and diagnostic settings have no concept of a contact list. Storing contact data alongside logs would also be ineffective since alert rules are evaluated independently of diagnostic destination configuration.
When this WOULD be correct
A question asks how to route Azure resource logs and metrics to a Log Analytics workspace for central analysis, or to archive them to a storage account. In that case, creating a diagnostic setting on each resource is the correct answer.
- ✗
A Log Analytics workbook used as the shared notification destination.
Why it's wrong here
A Log Analytics workbook is an interactive canvas for building reports and visualizations from query data, often used for dashboards and post-incident analysis. Workbooks are not an endpoint that can receive or process alert notifications; Azure Monitor action groups support delivery channels such as email, SMS, push notifications, webhooks, ITSM connections, and Automation runbooks. Even if a workbook were linked somewhere, it cannot execute an email or webhook when an alert fires, so it is fundamentally unsuitable as a shared notification destination. Workbooks complement alerts by visualizing their results, but they do not replace the action group mechanism.
When this WOULD be correct
When the question asks for a centralized, customizable dashboard to visualize and analyze alert data from multiple sources, a Log Analytics workbook would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An action group that can be attached to multiple Azure Monitor alert rules.Correct answer▾
Why this is correct
An action group is the reusable notification target in Azure Monitor. You define the recipients and actions once, then attach that action group to any metric, log, or activity log alert that should notify the same people. This separates alert detection from alert delivery, which keeps the design consistent across subscriptions and reduces repeated configuration. It is the right feature when the notification method must be shared broadly.
✗A metric alert with the same threshold applied to every resource that needs notification.Wrong answer — click to see why▾
Why this is wrong here
A metric alert defines a threshold condition, not a notification target. It cannot be reused across different alert rules or notification channels like email, SMS, and webhook.
★ When this WOULD be the correct answer
A metric alert would be correct if the question asked for a rule that fires when a specific metric exceeds a threshold, and the notification method is defined separately (e.g., via an action group).
Why candidates choose this
Candidates may confuse the alert rule itself with the notification configuration, thinking that a single metric alert can serve as a shared notification mechanism across resources.
✗A diagnostic setting on each resource so the contact list is stored with the logs.Wrong answer — click to see why▾
Why this is wrong here
Diagnostic settings send logs and metrics to storage, Event Hubs, or Log Analytics, but they do not define notification targets like email, SMS, or webhook. They cannot be used to trigger alerts or notify on-call groups.
★ When this WOULD be the correct answer
A question asks how to route Azure resource logs and metrics to a Log Analytics workspace for central analysis, or to archive them to a storage account. In that case, creating a diagnostic setting on each resource is the correct answer.
Why candidates choose this
Candidates may confuse diagnostic settings with action groups because both involve 'settings' that can be applied to resources, and they might think storing contact info with logs is a way to reuse notification targets.
✗A Log Analytics workbook used as the shared notification destination.Wrong answer — click to see why▾
Why this is wrong here
A Log Analytics workbook is a visualization and analysis tool, not a notification destination. It cannot send emails, SMS, or webhooks when alerts fire.
★ When this WOULD be the correct answer
When the question asks for a centralized, customizable dashboard to visualize and analyze alert data from multiple sources, a Log Analytics workbook would be the correct answer.
Why candidates choose this
Candidates may confuse workbooks with action groups because both can be used centrally, but workbooks are for reporting, not alert notifications.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Metric
A metric is a quantifiable measurement used to assess the performance, health, or status of IT systems, networks, or applications.
Key term
Azure Monitor
Azure Monitor is a cloud service that collects, analyzes, and acts on telemetry data from your Azure and on-premises resources to help you understand performance and availability.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.