AZ-104 Monitor and Maintain Azure Resources Practice Question
You need an alert that emails administrators when CPU on VM-DB01 exceeds a threshold. Which two Azure Monitor components work together to achieve this?
⚠ Common exam trap
Many candidates confuse 'budget alerts' (cost-based) with 'metric alerts' (performance-based), or assume that activity logs capture VM-level metrics like CPU, when they only record control-plane events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A metric alert and an action group
A metric alert monitors a specific performance metric (like CPU percentage) on a target resource (VM-DB01) and triggers when the value crosses a defined threshold. An action group defines the notification actions (e.g., sending an email to administrators) that execute when the alert fires. Together, they form the core alerting workflow in Azure Monitor: the metric alert evaluates the condition, and the action group delivers the response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A metric alert and an action group
Why this is correct
The correct approach for a threshold-based email alert on CPU utilization is to create a metric alert rule that targets the VM's 'Percentage CPU' signal, and then associate that rule with an action group that contains an 'Email/SMS/Push/Voice' action configured to notify administrators. The action group is a self-contained set of notification preferences, and the metric alert evaluates the telemetry at a specified frequency (e.g., every 5 minutes) and fires when the threshold (e.g., >80%) is breached.
- ✗
A budget alert and a private DNS zone
Why it's wrong here
A budget alert is designed to monitor cost or usage against a defined spending amount, not CPU performance, and it operates at the subscription, resource group, or management group level rather than on a single VM's virtual hardware. A private DNS zone is used to resolve names within a virtual network or between connected networks for internal addressing, and it has no integration with Azure Monitor metrics or alerting. Pairing these two components neither reads VM performance counters nor supports email notification for a CPU condition, so it cannot fulfill the requirement.
When this WOULD be correct
This option would be correct for a question like: 'You need to be notified when spending on a resource group exceeds a set amount, and ensure VMs can resolve custom domain names. Which two Azure components work together?'
- ✗
A Recovery Services vault and a route table
Why it's wrong here
A Recovery Services vault is built for backup and disaster recovery operations, such as storing Azure VM backups or replicating on-premises servers via Site Recovery; it does not ingest or analyze live metric streams like CPU usage. A route table is a networking construct that controls the next hop of outbound traffic from subnets or network interfaces, and it has no role in telemetry collection or alert triggering. Neither component can emit a metric-based alert, so combining them is technically irrelevant to the need for a CPU email alert.
When this WOULD be correct
You need to protect Azure VMs by enabling backup and configure network traffic routing to an on-premises network. Which two components would you use?
- ✗
An activity log export and a lock
Why it's wrong here
An activity log export sends the Azure platform's subscription-level operation logs (e.g., resource creation, configuration changes, or health events) to a Log Analytics workspace, Event Hub, or storage account, but it does not evaluate VM guest metrics such as CPU percentage. A lock (a management lock) prevents accidental deletion or modification of a resource by adding a read-only or delete restriction, and it does not inspect performance counters or generate notifications. This combination only captures administrative events and protects the resource—it does not monitor the VM's virtual processor utilization, so the required email alert will never be produced.
When this WOULD be correct
In a scenario where you need to export Azure activity logs to a storage account for long-term retention and compliance, and you want to prevent deletion of that storage account with a lock, then an activity log export and a lock would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A metric alert and an action groupCorrect answer▾
Why this is correct
The correct approach for a threshold-based email alert on CPU utilization is to create a metric alert rule that targets the VM's 'Percentage CPU' signal, and then associate that rule with an action group that contains an 'Email/SMS/Push/Voice' action configured to notify administrators. The action group is a self-contained set of notification preferences, and the metric alert evaluates the telemetry at a specified frequency (e.g., every 5 minutes) and fires when the threshold (e.g., >80%) is breached.
✗A budget alert and a private DNS zoneWrong answer — click to see why▾
Why this is wrong here
A budget alert monitors cost thresholds, not CPU performance, and a private DNS zone resolves names in a virtual network, not alerting. These components do not address CPU metric alerts or email notifications.
★ When this WOULD be the correct answer
This option would be correct for a question like: 'You need to be notified when spending on a resource group exceeds a set amount, and ensure VMs can resolve custom domain names. Which two Azure components work together?'
Why candidates choose this
Candidates may confuse 'budget alert' with 'metric alert' due to the word 'alert', and think a private DNS zone is needed for email delivery or network connectivity for alerts.
✗A Recovery Services vault and a route tableWrong answer — click to see why▾
Why this is wrong here
A Recovery Services vault is used for backup and disaster recovery, not for monitoring CPU metrics. A route table controls network traffic routing and has no role in alerting. Neither component can generate or deliver email alerts based on CPU thresholds.
★ When this WOULD be the correct answer
You need to protect Azure VMs by enabling backup and configure network traffic routing to an on-premises network. Which two components would you use?
Why candidates choose this
Candidates may confuse Recovery Services vault with Azure Monitor or think route tables are involved in alert delivery, or they may misremember the components needed for backup and networking scenarios.
✗An activity log export and a lockWrong answer — click to see why▾
Why this is wrong here
Activity log export sends logs to a storage account or event hub, not directly to email administrators. A lock prevents accidental deletion or modification of resources but does not trigger email alerts. Neither component can create an email alert for CPU threshold.
★ When this WOULD be the correct answer
In a scenario where you need to export Azure activity logs to a storage account for long-term retention and compliance, and you want to prevent deletion of that storage account with a lock, then an activity log export and a lock would be correct.
Why candidates choose this
Candidates may confuse activity log export with alerting, thinking it can send notifications, or they may think a lock is involved in security alerts. The term 'alert' in the question might lead them to consider any Azure component with 'log' or 'lock' as relevant.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Azure Monitor
Azure Monitor is a cloud service that collects, analyzes, and acts on telemetry data from your Azure and on-premises resources to help you understand performance and availability.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.