AZ-400 Develop a security and compliance plan Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable monitoring, then Create alert rule, then Set condition, then Configure action groups, then Test alert

  Why this is correct

  This is the correct order because you must first enable monitoring to collect data, then create the alert rule, define the condition that triggers the alert, configure the action groups to respond, and finally test the alert to validate the setup.

• ✗

  Enable monitoring, then Create alert rule, then Configure action groups, then Set condition, then Test alert

  Why it's wrong here

  Configuring action groups before defining the alert condition inverts the Azure Monitor alert rule creation flow. The condition—signal, threshold, and frequency—determines what event triggers the alert, and action groups are then associated with that specific firing condition via the rule's Actions tab. In the portal, you cannot meaningfully attach an action group without first establishing the condition, because the action group is invoked only when that condition evaluates true. Also, you risk selecting an action group that doesn't match the severity or type of condition defined later, making it an incorrectly ordered step.

• ✗

  Create alert rule, then Enable monitoring, then Set condition, then Configure action groups, then Test alert

  Why it's wrong here

  Creating an alert rule before enabling monitoring is impossible in practice because alert rules require a valid signal source from already collected telemetry. The resource's metrics or logs must be actively flowing into Azure Monitor—via diagnostic settings, data collection rules, or an installed agent—before the signal picker in the alert rule creation wizard returns any data to evaluate. Without enabled monitoring, the condition cannot be configured, and the rule would have no data to base its logic on, making it invalid or non-functional. Thus, enabling monitoring is the prerequisite for any meaningful alert rule.

• ✗

  Enable monitoring, then Create alert rule, then Set condition, then Test alert, then Configure action groups

  Why it's wrong here

  Testing the alert before configuring action groups validates only the detection half of the pipeline, leaving the notification path unverified. Action groups define the actual response—email, SMS, webhook, ITSM integration—and are a required component for an end-to-end alert test; otherwise, even if the condition fires, no one is notified. In Azure Monitor, the test feature triggers a notification through a named action group, so it is only possible to test once an action group exists and is linked to the rule. Therefore, placing test before actions breaks the validation workflow.

Go deeper

Related to this question