The team already exports subscription activity logs to a Log Analytics workspace and wants an alert that can ignore delete operations performed by a known automation account. What should they create?

An activity log alert at the subscription scope

Activity log alerts are useful for direct event monitoring, but they do not provide the same KQL filtering flexibility inside the workspace.

A metric alert on the subscription

Subscription metrics do not represent administrative delete operations and cannot filter the event details the team cares about.

A diagnostic setting on the resource group

Diagnostic settings can route logs, but they do not create alert logic or exclude a specific caller from triggering a notification.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: A scheduled query alert in Log Analytics using the AzureActivity table — A scheduled query alert is the best choice when the data is already in Log Analytics and the alert needs custom logic. The AzureActivity table can be queried with KQL to identify delete events and exclude those performed by the automation account. That level of filtering is not available in the same way with a basic metric alert, and it is more flexible than a simple activity log alert. Why others are wrong: An activity log alert can detect a delete event, but it is less flexible when you need custom exclusion logic against a specific caller. Metric alerts do not apply to management-plane deletes. Diagnostic settings only collect or route data; they do not evaluate the data and raise an alert by themselves.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.