Implement an instrumentation strategy →mediumMultiple ChoiceObjective-mapped

AZ-400 Implement an instrumentation strategy Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "properties": {
    "name": "test-rule",
    "description": "Alert when error rate > 5%",
    "severity": 2,
    "enabled": true,
    "scopes": ["/subscriptions/.../resourceGroups/.../providers/microsoft.insights/components/myapp"],
    "criteria": {
      "allOf": [
        {
          "metricName": "requests/count",
          "metricNamespace": "microsoft.insights/components",
          "operator": "GreaterThan",
          "threshold": 100,
          "timeAggregation": "Total",
          "dimensions": [
            {
              "name": "request/resultCode",
              "operator": "Include",
              "values": ["500"]
            }
          ]
        }
      ]
    }
  }
}
```

You have deployed an Azure Resource Manager (ARM) template for a scheduled query rule as shown. The rule is enabled and targets an Application Insights resource. However, no alerts are firing despite HTTP 500 errors occurring. What is the most likely cause?

⚠ Common exam trap

It's easy for candidates to assume an absolute count threshold is fine for error monitoring, but Azure's alerting logic requires careful consideration of traffic patterns—percentage-based conditions are essential for detecting error rate spikes in variable-load environments.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The threshold of 100 is too high; the rule should use a percentage-based condition on error rate.

The threshold of 100 is an absolute count, not a percentage. HTTP 500 errors may occur sporadically, but unless they reach 100 within the evaluation window, the alert will not fire. For error-rate monitoring, a percentage-based condition (e.g., >5% of total requests) is more appropriate to detect anomalies even with lower traffic volumes.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The severity is set to 2, which suppresses the alert.
Why it's wrong here
The severity of an Azure Monitor alert does not control whether the alert fires; it only classifies the impact. Severity 2 is a valid, non-suppressing severity level, so this choice incorrectly attributes suppression to severity.
✓
The threshold of 100 is too high; the rule should use a percentage-based condition on error rate.
Why this is correct
The rule should use a percentage-based condition on the failed request rate rather than an absolute count of 100. In low-traffic applications, 100 failed requests may represent a very high error percentage and go undetected, while a percentage threshold would trigger alerts based on the rate of failures relative to total requests.
✗
The metric name 'requests/count' is misspelled; it should be 'requests/count' (correct).
Why it's wrong here
The metric name 'requests/count' is not misspelled. In Application Insights, this is the standard metric identifier for the count of server requests, published under the 'azure.applicationinsights' metric namespace. The slash is an inherent part of the metric name, not a typo, and it is case-sensitive exactly as documented. Therefore, the alert rule's metric definition is valid, and the failure to fire is not due to a misspelled metric.
✗
The dimension filter for 'request/resultCode' includes '500' but should also include '5xx' wildcard.
Why it's wrong here
The dimension filter for 'request/resultCode' with the value '500' is valid and will match only requests with that exact result code. Azure Monitor dimension filters for this metric use exact values, not wildcards, so adding '5xx' is unnecessary and would not work as expected.

Go deeper

AZ-400 Implement an instrumentation strategy Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question