AZ-104 Monitor and Maintain Azure Resources Practice Question
You already created a metric alert rule. You want the alert to send email and call a webhook when it fires. Which component should you link to the alert rule?
⚠ Common exam trap
Many candidates confuse diagnostic settings (which export data) with action groups (which define alert responses), leading them to select A instead of C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An action group
An action group is the correct component because it defines the notification and automation actions (such as sending an email or invoking a webhook) that are triggered when a metric alert rule fires. In Azure Monitor, alert rules are linked to action groups to execute these responses; without an action group, the alert can only log the event but cannot perform any external notification or automation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A diagnostic setting
Why it's wrong here
A diagnostic setting funnels collected platform metrics and logs to storage accounts, event hubs, or Log Analytics workspaces for centralization and archival. It is a data export mechanism, not a notification delivery path, and it cannot send emails, SMS, or webhook calls when an alert fires. Diagnostic settings are complementary to alert rules—they don't replace the action group that receives actionable alert notifications.
When this WOULD be correct
When the question asks: 'You need to route platform logs and metrics from an Azure resource to a Log Analytics workspace for analysis. What should you configure?'
- ✗
A Log Analytics workspace
Why it's wrong here
A Log Analytics workspace is a centralized storage and querying repository for logs and some metrics; you can run KQL queries and build log alert rules on the data, but the workspace itself is not a destination for metric alert notifications. Metric alert rules evaluate resource metrics and then activate separate action groups; the workspace is simply one possible consumer of diagnostic export data. Thus a Log Analytics workspace might be where you analyze alert history, but it is not the target that receives or transmits the alert's notification.
When this WOULD be correct
A Log Analytics workspace would be the correct answer if the question asked: 'You want to collect and analyze performance and log data from multiple Azure resources. Which resource should you create?'
- ✓
An action group
Why this is correct
An action group is a resource that defines the notification and automation recipients for an alert—such as email, SMS, phone call, webhook, Azure function, ITSM, and automation runbook. When the metric alert condition is triggered, Azure sends the configured notifications to this group. You attach one or more action groups to the alert rule so that alerts are actually delivered; this is exactly what makes action groups the correct notification target.
- ✗
An Azure Policy initiative
Why it's wrong here
An Azure Policy initiative is a logical container of multiple policy definitions used to enforce lifecycle and compliance rules across resources, such as requiring specific Azure signatures or tag conventions. Initiatives are evaluated continuously and can take remediation actions, but they have no concept of an alert condition, firing notification, or webhook payload. Because an alert rule must call an action group to execute its notification logic, choosing an initiative describes governance, not alerting.
When this WOULD be correct
You need to enforce that all resources in a subscription have a specific tag for cost tracking. An Azure Policy initiative containing a policy that requires the tag would be the correct component to assign to the subscription.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An action groupCorrect answer▾
Why this is correct
An action group is a resource that defines the notification and automation recipients for an alert—such as email, SMS, phone call, webhook, Azure function, ITSM, and automation runbook. When the metric alert condition is triggered, Azure sends the configured notifications to this group. You attach one or more action groups to the alert rule so that alerts are actually delivered; this is exactly what makes action groups the correct notification target.
✗A diagnostic settingWrong answer — click to see why▾
Why this is wrong here
A diagnostic setting controls which Azure resource logs and metrics are sent to destinations like Log Analytics or storage, not the notification actions (email/webhook) triggered by an alert rule.
★ When this WOULD be the correct answer
When the question asks: 'You need to route platform logs and metrics from an Azure resource to a Log Analytics workspace for analysis. What should you configure?'
Why candidates choose this
Candidates may confuse diagnostic settings with alert actions because both involve 'settings' and can send data to external endpoints, but diagnostic settings are for data collection, not alert notifications.
✗A Log Analytics workspaceWrong answer — click to see why▾
Why this is wrong here
A Log Analytics workspace is used for collecting, analyzing, and querying log data, not for configuring notification actions like email or webhook when an alert fires. Alert rules use action groups to define notification actions.
★ When this WOULD be the correct answer
A Log Analytics workspace would be the correct answer if the question asked: 'You want to collect and analyze performance and log data from multiple Azure resources. Which resource should you create?'
Why candidates choose this
Candidates may confuse the role of Log Analytics workspaces in storing alert data (e.g., log alerts) with the mechanism for sending notifications, assuming the workspace itself handles notifications.
✗An Azure Policy initiativeWrong answer — click to see why▾
Why this is wrong here
An Azure Policy initiative is used to enforce compliance rules across resources, not to define notification actions for alerts. Alert rules require an action group to specify email, SMS, webhook, or other notifications.
★ When this WOULD be the correct answer
You need to enforce that all resources in a subscription have a specific tag for cost tracking. An Azure Policy initiative containing a policy that requires the tag would be the correct component to assign to the subscription.
Why candidates choose this
Candidates may confuse policy initiatives with alert actions because both involve 'rules' and 'compliance', leading them to think a policy initiative can trigger notifications when a condition is violated.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Dynamic Membership Groups
Key term
Action group
An Action group is a collection of notification and automation settings that defines how an Azure Monitor alert responds when triggered, such as who gets emailed, which phone numbers get called, or which automated tasks run.
Key term
Metric
A metric is a quantifiable measurement used to assess the performance, health, or status of IT systems, networks, or applications.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, a metric alert already exists for VM01, but the on-call team never receives an email when CPU exceeds 80% for 5 minutes. What should you configure to deliver the notification?
easy- A.Create a diagnostic setting on VM01 to export metrics to Log Analytics.
- ✓ B.Add an action group to the alert rule and configure email delivery.
- C.Assign the Reader role to the on-call team so they can view the alert.
- D.Create a resource lock on VM01 to prevent accidental changes.
Why B: The alert rule exists, but no notification action is configured. An action group defines how to notify administrators (e.g., email, SMS, webhook). Adding an action group with an email action to the existing alert rule will deliver the email when the CPU threshold is breached.
Variation 2. Based on the exhibit, the alert rule is firing, but the operations team is not receiving any notification. What should you change to make the alert send an email when the condition is met?
medium- A.Increase the evaluation frequency to 15 minutes so Azure sends a summary notification.
- ✓ B.Attach an action group that includes the required email recipient.
- C.Create a diagnostic setting on the virtual machine and send logs to a storage account.
- D.Move the virtual machine into a different resource group so the alert can notify the team.
Why B: An alert rule in Azure Monitor requires an action group to define the notification actions (e.g., email, SMS) when the alert fires. Without an action group attached to the alert rule, no notifications are sent, even if the condition is met. Option B correctly identifies that attaching an action group containing the required email recipient will enable email notifications.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.