AZ-104 Monitor and Maintain Azure Resources Practice Question
The subscription admin wants to receive an alert whenever anyone deletes a resource group, regardless of which resource type was inside it. Which alert type should be used?
⚠ Common exam trap
It's easy for candidates to confuse resource-level monitoring (metrics, logs) with control-plane monitoring (Activity Log), and assume a metric or log alert can detect a deletion event, when in fact only an activity log alert natively watches for Azure Resource Manager operations like resource group deletion.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An activity log alert targeting the delete resource group operation
The 'Delete Resource Group' operation is an Azure Resource Manager control-plane action that is automatically logged in the Azure Activity Log. An activity log alert can be configured to fire whenever this specific operation is recorded, regardless of the resource types inside the group. This is the only alert type that directly monitors management-plane events like resource group deletion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A metric alert on the deleted resource group's CPU
Why it's wrong here
The resource group is a logical container, not a compute resource, so it does not emit CPU or any performance metrics. After the resource group is deleted, its child resources no longer exist and no metric stream remains to trigger a threshold. Even when the group exists, a CPU metric from a VM inside it tells you nothing about the lifecycle event of the group itself, and metric alerts are designed for utilization patterns, not control-plane operations.
When this WOULD be correct
A metric alert on CPU would be correct if the question asked for a notification when a specific VM's CPU usage exceeds a threshold, e.g., 'Alert me when VM CPU > 90%'.
- ✗
A log alert on a custom KQL query in a workspace only
Why it's wrong here
A log alert on a custom KQL query works only after Azure Activity Logs have been streamed to a Log Analytics workspace via diagnostic settings, which means delivery depends on both the diagnostic configuration and workspace ingestion latency. While it could eventually detect the delete operation, the question asks for the native alerting mechanism for subscription events; an activity log alert inspects the activity log directly without needing a workspace or KQL query. Relying solely on a workspace query is indirect and introduces extra dependencies and potential data gaps.
When this WOULD be correct
This option would be correct if the question asked for an alert based on a specific condition derived from log data, such as 'alert when a certain error event is logged from a specific resource' or 'alert when a custom metric exceeds a threshold based on log analytics data'.
- ✓
An activity log alert targeting the delete resource group operation
Why this is correct
An activity log alert is the right tool for subscription-level events such as resource group deletion. It monitors the Azure Activity log directly, so it can react as soon as the delete operation is recorded. This avoids depending on resource-specific metrics or a separate workspace query pipeline for a basic administrative event.
- ✗
A backup alert from a Recovery Services vault
Why it's wrong here
Backup alerts from a Recovery Services vault are scoped to Azure Backup and Site Recovery workloads—they fire on backup job failures, corrupted backups, or restore issues. A resource group deletion is a management-plane event that produces no backup-related signal, so the vault would have no record of it. Such an alert cannot observe subscription-level control-plane operations unless you separately shipped Azure Activity logs to a workspace and built a custom query, which is not what this option describes.
When this WOULD be correct
A question asking for an alert when a backup job fails for a VM protected by Azure Backup, with the alert type being a backup alert from a Recovery Services vault.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An activity log alert targeting the delete resource group operationCorrect answer▾
Why this is correct
An activity log alert is the right tool for subscription-level events such as resource group deletion. It monitors the Azure Activity log directly, so it can react as soon as the delete operation is recorded. This avoids depending on resource-specific metrics or a separate workspace query pipeline for a basic administrative event.
✗A metric alert on the deleted resource group's CPUWrong answer — click to see why▾
Why this is wrong here
A metric alert on CPU monitors performance metrics, not resource group deletion events. It cannot detect administrative operations like deletions.
★ When this WOULD be the correct answer
A metric alert on CPU would be correct if the question asked for a notification when a specific VM's CPU usage exceeds a threshold, e.g., 'Alert me when VM CPU > 90%'.
Why candidates choose this
Candidates may think any alert can be configured on a resource group, or confuse metric alerts (performance-based) with activity log alerts (operation-based).
✗A log alert on a custom KQL query in a workspace onlyWrong answer — click to see why▾
Why this is wrong here
A log alert on a custom KQL query in a workspace only monitors log data ingested into a Log Analytics workspace, not resource-level operations like resource group deletion. The question requires an alert on the delete action itself, which is captured by activity logs, not workspace logs.
★ When this WOULD be the correct answer
This option would be correct if the question asked for an alert based on a specific condition derived from log data, such as 'alert when a certain error event is logged from a specific resource' or 'alert when a custom metric exceeds a threshold based on log analytics data'.
Why candidates choose this
Candidates may confuse activity logs with log analytics workspace logs, or think that a custom KQL query can capture any event, not realizing that resource group deletion is an Azure Resource Manager operation logged in the activity log, not in workspace logs.
✗A backup alert from a Recovery Services vaultWrong answer — click to see why▾
Why this is wrong here
Backup alerts from a Recovery Services vault notify about backup failures or issues, not about resource group deletion events.
★ When this WOULD be the correct answer
A question asking for an alert when a backup job fails for a VM protected by Azure Backup, with the alert type being a backup alert from a Recovery Services vault.
Why candidates choose this
Candidates may confuse backup alerts with general operational alerts, thinking they cover all deletion scenarios, or they may not distinguish between activity log and backup alert types.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Activity log
An activity log is a record of all operations performed on Azure resources, capturing who did what, when, and where, for auditing and troubleshooting purposes.
Key term
Azure resource
An Azure resource is a manageable item available through Microsoft Azure, such as a virtual machine, database, or web app.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.