AZ-104 Monitor and Maintain Azure Resources Practice Question
You need to suppress alert notifications for a group of virtual machines every Sunday during a planned maintenance window, without deleting the underlying alert rules. What should you configure?
⚠ Common exam trap
Watch out — candidates often confuse disabling diagnostic settings (which stops data collection) with suppressing notifications, or think that modifying the underlying alert rule is required, when Azure provides a dedicated alert processing rule feature for this exact scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an alert processing rule for the maintenance window.
An alert processing rule (formerly action rule) allows you to apply actions or suppress notifications for specific alert rules during defined time windows without modifying the underlying alert rules. By configuring a suppression action rule for the maintenance window (every Sunday), you can prevent notifications from being sent while the alert rules remain active and continue to evaluate conditions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable diagnostic settings during the maintenance window.
Why it's wrong here
Diagnostic settings control the collection and routing of platform logs and metrics to destinations like Log Analytics, Storage, or Event Hubs—they do not directly control alert action groups or notification delivery. Disabling diagnostic settings during a maintenance window would stop data egress and can break log-based alert conditions, while metric alerts might still trigger on missing data depending on alert logic. It is a data-plane change that affects observability for all resources, not a targeted suppression of notification actions from existing alert rules.
When this WOULD be correct
You need to temporarily stop collecting diagnostic data from a set of VMs to reduce costs during a maintenance window, without deleting the diagnostic settings permanently. Disabling diagnostic settings would be the correct action to stop data ingestion and associated costs.
- ✓
Create an alert processing rule for the maintenance window.
Why this is correct
An alert processing rule (formerly an action rule) can be configured with a maintenance window schedule to suppress notifications for a scoped set of virtual machines. During that defined time range, the rule overrides future alert actions by discarding or modifying them, while the underlying alert rules continue to evaluate and fire. This preserves your alert rule configuration, avoids false silence outside the window, and keeps the audit trail/history of fired alerts intact.
- ✗
Delete and recreate the alert rules every week.
Why it's wrong here
Deleting and recreating alert rules every week is operationally inefficient and introduces monitoring gaps during the recreation period. Every alert rule change loses its configuration, customizations, and action group bindings, and you must manually track which rules were deleted and recreate them identically. It also creates a risk of human error and does not guarantee that notifications are actually suppressed—it just removes monitoring entirely until the rule is recreated.
When this WOULD be correct
If an exam question asks for a method to permanently remove alert rules for a specific time period and you are allowed to recreate them manually each week, this could be a valid approach, though not recommended.
- ✗
Move the VMs to a different subscription on Sundays.
Why it's wrong here
Moving the VMs to a different subscription on Sundays is not an alerting solution and would trigger a cross-subscription resource move with significant side effects. Resource moves require re-evaluation of policies, RBAC assignments, and potentially changes to resource IDs, and they may cause dependent resources to be unavailable or incur data movement costs. This approach does not selectively suppress notifications; it disrupts the entire VM infrastructure and its management plane for no alerting benefit.
When this WOULD be correct
You need to isolate a set of VMs for separate cost tracking or compliance requirements, and moving them to a different subscription is the only way to apply distinct policies or billing. The question would specify that alert suppression is not the goal.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create an alert processing rule for the maintenance window.Correct answer▾
Why this is correct
An alert processing rule (formerly an action rule) can be configured with a maintenance window schedule to suppress notifications for a scoped set of virtual machines. During that defined time range, the rule overrides future alert actions by discarding or modifying them, while the underlying alert rules continue to evaluate and fire. This preserves your alert rule configuration, avoids false silence outside the window, and keeps the audit trail/history of fired alerts intact.
✗Disable diagnostic settings during the maintenance window.Wrong answer — click to see why▾
Why this is wrong here
Disabling diagnostic settings stops the collection of metrics and logs, but it does not suppress alert notifications from existing alert rules that are already configured. Alerts based on those diagnostics would not fire because data stops flowing, but the rules remain active and would resume firing once diagnostics are re-enabled, which is not the same as suppressing notifications during a planned window.
★ When this WOULD be the correct answer
You need to temporarily stop collecting diagnostic data from a set of VMs to reduce costs during a maintenance window, without deleting the diagnostic settings permanently. Disabling diagnostic settings would be the correct action to stop data ingestion and associated costs.
Why candidates choose this
Candidates may confuse diagnostic settings with alert rules, thinking that disabling diagnostics will also suppress alerts, or they may believe that alerts are directly tied to the diagnostic data stream rather than being separate rule-based evaluations.
✗Delete and recreate the alert rules every week.Wrong answer — click to see why▾
Why this is wrong here
Deleting and recreating alert rules every week is inefficient, error-prone, and does not suppress notifications during maintenance; it removes the rules entirely, which is not required.
★ When this WOULD be the correct answer
If an exam question asks for a method to permanently remove alert rules for a specific time period and you are allowed to recreate them manually each week, this could be a valid approach, though not recommended.
Why candidates choose this
Candidates may think that deleting and recreating rules is a straightforward way to stop alerts temporarily, overlooking the existence of alert processing rules that can suppress notifications without deleting rules.
✗Move the VMs to a different subscription on Sundays.Wrong answer — click to see why▾
Why this is wrong here
Moving VMs to a different subscription on Sundays is an overly complex and disruptive approach that doesn't suppress alerts; it changes the management boundary and may affect other resources and policies.
★ When this WOULD be the correct answer
You need to isolate a set of VMs for separate cost tracking or compliance requirements, and moving them to a different subscription is the only way to apply distinct policies or billing. The question would specify that alert suppression is not the goal.
Why candidates choose this
Candidates might think that moving VMs to a different subscription would automatically stop alerts from the original subscription, but this is inefficient and ignores Azure's built-in alert processing rules for suppression.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Virtual Machine Deployment
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Maintenance window
A scheduled period during which IT systems can be taken offline for updates, patches, or repairs with minimal business disruption.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.