AZ-104 Monitor and Maintain Azure Resources Practice Question
The operations team wants an email and SMS notification whenever any production virtual machine's average CPU stays above 85 percent for 10 minutes. They also want to reuse the same notification targets for future alerts. What should they configure?
⚠ Common exam trap
Test-takers frequently confuse diagnostic settings (which only export data) with alert rules that require an action group to deliver notifications, or they mistakenly think a resource lock can provide monitoring capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An action group attached to a metric alert rule
An action group in Azure Monitor defines the notification targets (email, SMS, etc.) for alerts, and a metric alert rule can be configured to trigger when the average CPU percentage exceeds 85% for 10 minutes. By attaching the same action group to multiple alert rules, the operations team can reuse the notification targets for future alerts without reconfiguring them each time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A diagnostic setting on each VM that sends metrics to a storage account
Why it's wrong here
A diagnostic setting on each VM exports platform metrics and guest OS telemetry to a destination like a storage account, Event Hubs, or a Log Analytics workspace. This configuration only moves data; it does not contain any alert logic, threshold definitions, or notification endpoints. Without an attached alert rule and an action group, the exported CPU data simply sits in the storage account and can never produce an email or SMS message.
When this WOULD be correct
If the question asked for long-term retention of VM performance metrics for compliance or auditing purposes, configuring a diagnostic setting to stream metrics to a storage account would be correct.
- ✓
An action group attached to a metric alert rule
Why this is correct
An action group centralizes the email and SMS targets, and a metric alert can evaluate CPU percentage over a 10-minute window. Linking the alert to the action group gives the team reusable notifications for future monitoring rules without recreating contact information each time.
- ✗
A Log Analytics query alert with no notification target
Why it's wrong here
A Log Analytics query alert that fires based on a KQL query over workspace logs still requires an action group (or an alert processing rule) assigned to it in order to send email or SMS. If no notification target is configured, the alert enters an 'Fired' state silently, and the operations team receives nothing. While this approach can work for log-based signals, it introduces ingestion latency and is overengineered compared to a metric alert for a simple CPU percentage threshold monitored over a 10-minute window.
When this WOULD be correct
This option would be correct if the question asked for a way to analyze historical CPU trends across multiple VMs without requiring immediate notifications, and the team planned to add notification targets later via an action group.
- ✗
A resource lock on the virtual machines
Why it's wrong here
A resource lock, whether ReadOnly or CanNotDelete, is an Azure Resource Manager control-plane safeguard that protects a VM from accidental deletion or modification. It does not monitor guest or host metrics, evaluate CPU utilization thresholds, or trigger any notification channel such as email or SMS. Therefore, a lock addresses change management but is entirely incapable of satisfying the operations team's requirement for proactive alerting.
When this WOULD be correct
A resource lock would be correct in a scenario where the question asks how to prevent accidental deletion or modification of critical virtual machines, such as production VMs, to ensure they are not inadvertently removed or altered.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An action group attached to a metric alert ruleCorrect answer▾
Why this is correct
An action group centralizes the email and SMS targets, and a metric alert can evaluate CPU percentage over a 10-minute window. Linking the alert to the action group gives the team reusable notifications for future monitoring rules without recreating contact information each time.
✗A diagnostic setting on each VM that sends metrics to a storage accountWrong answer — click to see why▾
Why this is wrong here
A diagnostic setting sending metrics to a storage account only archives data for later analysis; it does not trigger real-time notifications like email or SMS when CPU exceeds a threshold.
★ When this WOULD be the correct answer
If the question asked for long-term retention of VM performance metrics for compliance or auditing purposes, configuring a diagnostic setting to stream metrics to a storage account would be correct.
Why candidates choose this
Candidates may confuse diagnostic settings with alerting, thinking that sending metrics to storage enables notifications, or they may overlook the requirement for immediate notification.
✗A Log Analytics query alert with no notification targetWrong answer — click to see why▾
Why this is wrong here
A Log Analytics query alert with no notification target cannot send email or SMS notifications, which is a core requirement of the question.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a way to analyze historical CPU trends across multiple VMs without requiring immediate notifications, and the team planned to add notification targets later via an action group.
Why candidates choose this
Candidates may think a Log Analytics query alert is necessary for complex metric conditions like average CPU over 85% for 10 minutes, but a metric alert rule can handle this directly without Log Analytics.
✗A resource lock on the virtual machinesWrong answer — click to see why▾
Why this is wrong here
Resource locks prevent accidental deletion or modification of resources but do not provide any monitoring or notification capabilities for performance metrics like CPU usage.
★ When this WOULD be the correct answer
A resource lock would be correct in a scenario where the question asks how to prevent accidental deletion or modification of critical virtual machines, such as production VMs, to ensure they are not inadvertently removed or altered.
Why candidates choose this
Candidates might confuse resource locks with a security or management feature that could be used to 'lock down' monitoring settings, not realizing locks have no effect on alerting or notifications.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Action group
An Action group is a collection of notification and automation settings that defines how an Azure Monitor alert responds when triggered, such as who gets emailed, which phone numbers get called, or which automated tasks run.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.