AZ-104 Monitor and Maintain Azure Resources Practice Question
The subscription activity log is being sent to a Log Analytics workspace. An alert must fire when any resource group is deleted, but delete operations initiated by the automation account rg-cleaner@contoso.com must be ignored. Which query should be used in the alert rule?
⚠ Common exam trap
Candidates often choose Option A because they see 'delete' in the operation name, but they fail to realize that a broad 'contains' filter will match many unrelated delete operations and does not exclude the automation account's caller identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AzureActivity | where OperationNameValue == "Microsoft.Resources/subscriptions/resourceGroups/delete" | where ActivityStatusValue == "Succeeded" | where Caller != "rg-cleaner@contoso.com" | summarize Count = count()
It filters for the exact operation that deletes a resource group (Microsoft.Resources/subscriptions/resourceGroups/delete), ensures the deletion succeeded, and excludes the caller 'rg-cleaner@contoso.com'. This meets the requirement to fire an alert only when a resource group is deleted by any user except the automation account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AzureActivity | where ResourceProviderValue == "Microsoft.Resources" | where OperationName contains "delete"
Why it's wrong here
AzureActivity stores the subscription-level activity log, and ResourceProviderValue == 'Microsoft.Resources' includes not only resource group deletions but also other resource provider operations such as deployments, policy assignments, and diagnostic settings. Filtering on OperationName contains 'delete' performs a substring match on the localized display name, which can both miss an operation (because OperationName may be a localized label rather than the canonical OperationNameValue) and match unrelated operations like 'Microsoft.Resources/deployments/delete' or template deployment deletions. That broad predicate would trigger a log alert for any successful delete under Microsoft.Resources, not specifically a resource group delete, producing false positives.
When this WOULD be correct
This query would be correct if the requirement was to alert on any delete operation (not just resource group deletion) across all resource providers, and no exclusion of specific callers was needed.
- ✓
AzureActivity | where OperationNameValue == "Microsoft.Resources/subscriptions/resourceGroups/delete" | where ActivityStatusValue == "Succeeded" | where Caller != "rg-cleaner@contoso.com" | summarize Count = count()
Why this is correct
This query targets the exact delete operation for resource groups in AzureActivity, limits results to successful deletions, and excludes the automation account caller. A log alert can trigger when the result count is greater than zero. It is the most accurate choice because it filters by both operation identity and exception handling, which prevents false alerts from the known automation runbook.
- ✗
Heartbeat | where Computer == "rg-cleaner@contoso.com" | where TimeGenerated > ago(1d)
Why it's wrong here
The Heartbeat table contains agent health records from Azure Monitor agents installed on virtual machines, with Computer identifying the VM name — not a user or service principal such as 'rg-cleaner@contoso.com'. This query filters on a UPN-like caller identifier against the wrong column and only looks at the last day, but Heartbeat has no relationship to Azure Resource Manager operations. No data in Heartbeat records resource group deletions, so this alert condition would never fire and is entirely irrelevant to the requirement.
When this WOULD be correct
This query would be correct in an alert rule that monitors the health or connectivity of the automation account 'rg-cleaner@contoso.com' by checking if its heartbeat has been received in the last day.
- ✗
SecurityEvent | where EventID == 4688 | where Account == "rg-cleaner@contoso.com"
Why it's wrong here
SecurityEvent captures Windows security audit logs from machines with the Log Analytics agent, and Event ID 4688 specifically indicates process creation, not an Azure control-plane action like deleting a resource group. The Account field in that table is the username associated with the local Windows security event, which has no correlation with the Caller identity in AzureActivity. Even if the automation account ran a logon session, SecurityEvent can't observe Azure Resource Manager delete operations, so this query fundamentally targets the wrong log source.
When this WOULD be correct
This query would be correct if the question asked to detect when a specific user (e.g., rg-cleaner) initiates a process on a monitored Windows machine, such as alerting on suspicious command execution by that account.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓AzureActivity | where OperationNameValue == "Microsoft.Resources/subscriptions/resourceGroups/delete" | where ActivityStatusValue == "Succeeded" | where Caller != "rg-cleaner@contoso.com" | summarize Count = count()Correct answer▾
Why this is correct
This query targets the exact delete operation for resource groups in AzureActivity, limits results to successful deletions, and excludes the automation account caller. A log alert can trigger when the result count is greater than zero. It is the most accurate choice because it filters by both operation identity and exception handling, which prevents false alerts from the known automation runbook.
✗AzureActivity | where ResourceProviderValue == "Microsoft.Resources" | where OperationName contains "delete"Wrong answer — click to see why▾
Why this is wrong here
This query does not filter by the specific resource group delete operation (OperationNameValue) and does not exclude the automation account caller. It would trigger alerts for any delete operation on any resource, including non-resource-group deletes and those initiated by rg-cleaner@contoso.com.
★ When this WOULD be the correct answer
This query would be correct if the requirement was to alert on any delete operation (not just resource group deletion) across all resource providers, and no exclusion of specific callers was needed.
Why candidates choose this
Candidates may think that checking for 'delete' in the OperationName is sufficient, overlooking the need for precise operation filtering and caller exclusion. The broad match seems easier and appears to cover the requirement.
✗Heartbeat | where Computer == "rg-cleaner@contoso.com" | where TimeGenerated > ago(1d)Wrong answer — click to see why▾
Why this is wrong here
The Heartbeat table contains agent health data, not resource group deletion events. The query checks if the automation account computer exists, not if a resource group was deleted.
★ When this WOULD be the correct answer
This query would be correct in an alert rule that monitors the health or connectivity of the automation account 'rg-cleaner@contoso.com' by checking if its heartbeat has been received in the last day.
Why candidates choose this
Candidates may mistakenly think the Heartbeat table logs user actions or that the automation account name is a computer name, leading them to believe this query can filter out its operations.
✗SecurityEvent | where EventID == 4688 | where Account == "rg-cleaner@contoso.com"Wrong answer — click to see why▾
Why this is wrong here
SecurityEvent tracks Windows security events (like process creation), not Azure resource deletions. The question requires monitoring Azure subscription activity logs for resource group deletions, which SecurityEvent does not capture.
★ When this WOULD be the correct answer
This query would be correct if the question asked to detect when a specific user (e.g., rg-cleaner) initiates a process on a monitored Windows machine, such as alerting on suspicious command execution by that account.
Why candidates choose this
Candidates may confuse Azure activity logging with Windows security auditing, or incorrectly assume that user account information from SecurityEvent can be used to filter Azure resource operations.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Alert rule
An alert rule is a set of conditions and actions that trigger a notification when a monitored metric or log reaches a predefined threshold.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, a subscription activity log is already being sent to Log Analytics. The operations team wants an alert that fires when any resource group is deleted, but it should ignore deletions performed by a known automation account. Which approach should the administrator use?
medium- A.Create a metric alert on CPU percentage for the subscription.
- ✓ B.Create a log alert using the AzureActivity table and filter out the automation caller.
- C.Enable a diagnostic setting on the resource group object.
- D.Apply an Azure Policy deny assignment to all deletions.
Why B: The AzureActivity table in Log Analytics captures all control-plane operations, including resource group deletions. By creating a log alert query that filters on OperationNameValue='MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE' and excludes Caller where it matches the automation account's service principal or object ID, the alert triggers only for non-automation deletions. This approach leverages the existing activity log stream to Log Analytics without additional configuration.
Variation 2. The team already exports subscription activity logs to a Log Analytics workspace and wants an alert that can ignore delete operations performed by a known automation account. What should they create?
medium- A.An activity log alert at the subscription scope
- ✓ B.A scheduled query alert in Log Analytics using the AzureActivity table
- C.A metric alert on the subscription
- D.A diagnostic setting on the resource group
Why B: A scheduled query alert in Log Analytics can query the AzureActivity table to filter out delete operations performed by a specific automation account. This allows the alert to ignore those operations by excluding them in the query logic, which is not possible with activity log alerts that lack such granular filtering.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.