AZ-104 Monitor and Maintain Azure Resources Practice Question
The team already exports subscription activity logs to a Log Analytics workspace and wants an alert that can ignore delete operations performed by a known automation account. What should they create?
⚠ Common exam trap
It's easy for candidates to assume activity log alerts can filter by caller identity, but they only support static conditions like operation name or severity, not dynamic exclusion of specific principals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A scheduled query alert in Log Analytics using the AzureActivity table
A scheduled query alert in Log Analytics can query the AzureActivity table to filter out delete operations performed by a specific automation account. This allows the alert to ignore those operations by excluding them in the query logic, which is not possible with activity log alerts that lack such granular filtering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An activity log alert at the subscription scope
Why it's wrong here
An activity log alert at the subscription scope is the closest traditional alert type, but it only supports simple condition matching—for example, selecting a single operation name, status, resource, or caller value. It cannot run a full KQL query against the AzureActivity table, so you cannot combine multiple predicates such as 'delete operation AND caller is the automation account' in one flexible expression, nor can you join with other tables in the workspace. That lack of query flexibility makes it a weaker fit than a scheduled query alert when the alert logic must exclude a specific caller.
When this WOULD be correct
If the requirement was to alert on any delete operation in the subscription without needing to exclude specific actors, an activity log alert at subscription scope would be appropriate.
- ✓
A scheduled query alert in Log Analytics using the AzureActivity table
Why this is correct
Because the activity logs are already in Log Analytics, a scheduled query alert gives the team full KQL flexibility. They can filter by operation name and exclude actions performed by the automation account before firing the alert. This is the best choice when alert logic must be more specific than a standard activity log rule.
- ✗
A metric alert on the subscription
Why it's wrong here
Subscription-level metric alerts operate on numeric performance metrics (such as CPU, latency, or request counts) and do not represent administrative events like deletion operations. The AzureActivity data stream is not exposed as a metric, so there is no value to threshold or evaluate. Even if you created a custom metric, it cannot ingest activity log entries in a way that lets you filter by operation name or caller for this use case.
When this WOULD be correct
A metric alert on the subscription would be correct if the team needed to alert on a metric threshold, such as when the number of failed deployments exceeds a certain count, or when resource usage spikes above a defined limit.
- ✗
A diagnostic setting on the resource group
Why it's wrong here
A diagnostic setting on a resource group is designed solely to route activity logs or platform logs to a specified destination—such as a Log Analytics workspace, Event Hub, or storage account—and it contains no alerting or notification logic whatsoever. Enabling it changes the flow of data, but it does not create any rule that can fire when a delete operation occurs or filter out a specific caller. Therefore, configuring a diagnostic setting cannot satisfy the requirement to alert on the activity log; you would still need a separate scheduled query alert or activity log alert.
When this WOULD be correct
A diagnostic setting on the resource group would be correct if the question asked: 'The team needs to route resource group-level activity logs to a Log Analytics workspace for long-term retention and analysis.' In that case, the diagnostic setting enables the data flow, not alerting.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A scheduled query alert in Log Analytics using the AzureActivity tableCorrect answer▾
Why this is correct
Because the activity logs are already in Log Analytics, a scheduled query alert gives the team full KQL flexibility. They can filter by operation name and exclude actions performed by the automation account before firing the alert. This is the best choice when alert logic must be more specific than a standard activity log rule.
✗An activity log alert at the subscription scopeWrong answer — click to see why▾
Why this is wrong here
An activity log alert at subscription scope cannot filter out specific operations (like delete) from a known automation account; it alerts on all matching operations without exclusion logic.
★ When this WOULD be the correct answer
If the requirement was to alert on any delete operation in the subscription without needing to exclude specific actors, an activity log alert at subscription scope would be appropriate.
Why candidates choose this
Candidates may think activity log alerts can filter by operation and caller, but they lack the query flexibility to exclude specific accounts, leading them to choose this simpler option.
✗A metric alert on the subscriptionWrong answer — click to see why▾
Why this is wrong here
Metric alerts monitor performance metrics (e.g., CPU, memory) and cannot filter or alert on specific activity log operations like delete actions from a known automation account.
★ When this WOULD be the correct answer
A metric alert on the subscription would be correct if the team needed to alert on a metric threshold, such as when the number of failed deployments exceeds a certain count, or when resource usage spikes above a defined limit.
Why candidates choose this
Candidates may confuse metric alerts with activity log alerts, thinking they can monitor operational events, or they may assume 'subscription' scope implies activity log monitoring.
✗A diagnostic setting on the resource groupWrong answer — click to see why▾
Why this is wrong here
A diagnostic setting on the resource group sends logs to a destination (like Log Analytics or storage), but it does not create alerts. The question requires an alert that can filter out specific operations, which diagnostic settings cannot do.
★ When this WOULD be the correct answer
A diagnostic setting on the resource group would be correct if the question asked: 'The team needs to route resource group-level activity logs to a Log Analytics workspace for long-term retention and analysis.' In that case, the diagnostic setting enables the data flow, not alerting.
Why candidates choose this
Candidates may confuse diagnostic settings with alerting, thinking that enabling log collection automatically triggers alerts, or they may misread the question as asking about log collection rather than alert creation.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Monitor and Log Analytics
Key term
Subscription
A subscription is a payment model where you pay a recurring fee to access a product or service instead of buying it once and owning it forever.
Key term
Activity log
An activity log is a record of all operations performed on Azure resources, capturing who did what, when, and where, for auditing and troubleshooting purposes.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.