The team needs alerts for VM CPU and storage capacity thresholds, but they want to keep telemetry ingestion costs as low as possible. Which approach is best?

Send all VM diagnostic logs to Log Analytics and create only log search alerts.

Log-based alerts can work, but they require more ingestion and are usually more expensive than metric alerts for simple threshold conditions.

Create a Recovery Services vault backup policy with a short retention period.

Backup policies protect data recovery, but they do not create operational threshold alerts for CPU or storage capacity.

Assign Azure Policy to the subscription to audit CPU and storage trends.

Azure Policy can audit configuration compliance, but it does not track runtime telemetry or trigger threshold notifications.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Use Azure Monitor metric alerts for the threshold conditions. — For threshold monitoring of native Azure metrics, metric alerts are the most cost-effective choice. They avoid the higher ingestion and retention costs associated with sending large volumes of logs to Log Analytics. Since CPU and many storage capacity indicators are available as metrics, Azure Monitor can evaluate them directly and notify the team when thresholds are crossed. This keeps the solution simple, fast, and economical. Why others are wrong: Log-based alerts are useful when you need queryable detail, but they are usually not the lowest-cost option for straightforward threshold conditions. Backup policies address restore and retention, not monitoring. Azure Policy handles governance and compliance, not performance telemetry. The right answer is to use metric alerts when the data already exists as a platform metric.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.