AZ-305 Practice Question: Design identity, governance, and monitoring solutions
You need to configure a monitoring solution for Azure virtual machines that collects performance counters, event logs, and enables alerting based on CPU usage exceeding 90%. Which Azure service should you use?
⚠ Common exam trap
Many exam-takers confuse Azure Monitor with Microsoft Sentinel because both involve log collection and alerts, but Sentinel is specifically for security incidents, not general performance monitoring and threshold-based alerting on metrics like CPU usage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Monitor
Azure Monitor is the correct service because it provides a unified platform for collecting performance counters and event logs from Azure VMs via the Log Analytics agent or Azure Monitor Agent, and it supports metric-based alert rules that can trigger when CPU usage exceeds a defined threshold (e.g., 90%). This directly meets the requirements for monitoring, log collection, and alerting without additional services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is a governance service that evaluates Azure resources against rules for compliance, such as allowed locations, tagging, or encryption requirements. It operates on the control plane of Azure Resource Manager, inspecting resource properties rather than guest OS telemetry, so it cannot collect or alert on CPU, memory, or disk performance data from virtual machines.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native SIEM and SOAR platform focused on security analytics, threat detection, and incident response. While it can ingest logs via data connectors, it is not designed for continuous collection of guest OS performance counters like processor utilization or free memory, and it does not natively provide metric-based alerting for performance monitoring scenarios.
- ✓
Azure Monitor
Why this is correct
Azure Monitor is the core monitoring service in Azure that ingests platform metrics, activity logs, and guest OS telemetry via agents like the Azure Monitor Agent. It supports metric and log-based alerts, custom workbooks, and dashboards for performance counters such as CPU %, memory, and disk I/O, making it the appropriate solution for this monitoring need.
- ✗
Azure Update Manager
Why it's wrong here
Azure Update Manager is a service for managing operating system updates on virtual machines, including patch assessment, deployment, and update compliance reporting. It does not collect performance data like CPU usage or memory consumption, and its alerting capabilities are limited to update status, not runtime performance metrics, so it would not satisfy the requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.