The subscription admin wants to receive an alert whenever anyone deletes a resource group, regardless of which resource type was inside it. Which alert type should be used?

A metric alert on the deleted resource group's CPU

CPU metrics cannot detect a deletion event, and the resource would no longer exist after deletion.

A log alert on a custom KQL query in a workspace only

A log alert can work if the activity data is already in a workspace, but the question asks for the native alert type for this subscription event.

A backup alert from a Recovery Services vault

Backup alerts relate to backup jobs and vault operations, not to management-plane actions like deleting a resource group.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: An activity log alert targeting the delete resource group operation — Activity log alerts are designed for management-plane events in Azure, including creating, updating, and deleting resources at subscription scope. A resource group deletion is captured in the Azure Activity log, so the alert can trigger directly from that event without requiring a log query workspace or a metric condition. This makes it the simplest and most appropriate choice for the requirement. Why others are wrong: CPU metrics have no relationship to a deletion action. A workspace log alert could work only after activity data is ingested and queried, which is not the most direct answer here. Recovery Services vault alerts apply to backup workflows, not Azure resource group management events.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.