AZ-900 Describe Azure management and governance Practice Question
A company uses Azure and wants to ensure that their IT team receives alerts when virtual machines are deallocated unexpectedly. Which Azure service should they use to create a rule that triggers an action when a VM is deallocated?
⚠ Common exam trap
Candidates often confuse Azure Service Health (which monitors Azure platform health) with Azure Monitor (which monitors resource-level events), leading them to choose Option A for operational alerts like VM deallocation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Monitor
Azure Monitor is the correct service because it provides a unified platform for collecting, analyzing, and acting on telemetry from Azure resources. By creating an alert rule in Azure Monitor with a signal type of 'Administrative' (Azure Activity Log), you can trigger an action group (e.g., email, SMS, webhook) specifically when a virtual machine is deallocated, as this event is logged as an administrative operation in the Activity Log.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Service Health
Why it's wrong here
Azure Service Health is not the right choice because it focuses on the availability and incidents of Azure services themselves, such as regional outages or service degradations, not on resource-specific operations like an individual VM being deallocated. While Service Health can notify you about maintenance and health issues across the platform, it does not expose per-resource activity logs or allow alerting on your own VM lifecycle events.
When this WOULD be correct
When the question asks for a service that alerts about Azure service outages or planned maintenance affecting multiple subscriptions, Azure Service Health would be correct. For example: 'Which service provides alerts when Azure experiences a region-wide outage?'
- ✓
Azure Monitor
Why this is correct
Azure Monitor is the correct service because it captures and retains the Activity Log, which records control-plane events such as virtual machine deallocation. By creating an Activity Log alert rule, you can define a condition that fires when the 'Deallocate Virtual Machine' operation occurs, sending notifications via action groups to email, SMS, or webhook. This makes Azure Monitor the go-to for real-time, resource-level operational alerts.
- ✗
Azure Advisor
Why it's wrong here
Azure Advisor is a free service that analyzes your configurations and offers best practices for cost, security, reliability, and performance. It provides snapshots of recommendations on a dashboard, but it does not generate real-time alerts when a VM is deallocated. Advisor's role is reactive guidance, not event-driven notification, so it cannot satisfy the requirement to alert the IT team on individual resource operations.
When this WOULD be correct
Azure Advisor would be the correct answer if the question asked: 'Which Azure service provides recommendations to improve the reliability of virtual machines by suggesting availability zone configurations?'
- ✗
Azure Policy
Why it's wrong here
Azure Policy is used to enforce organizational standards and assess compliance by applying rules to resources during creation or update. It can prevent unauthorized deallocations via deny effects but does not emit event-driven notifications when a VM is deallocated. Policy is about governance and compliance control, not operational alerting, so it is incorrect for this scenario.
When this WOULD be correct
An exam question asks: 'A company needs to ensure that all virtual machines deployed in a subscription have a specific tag. Which Azure service should they use to enforce this requirement?' In that scenario, Azure Policy would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure MonitorCorrect answer▾
Why this is correct
Azure Monitor is the correct service because it captures and retains the Activity Log, which records control-plane events such as virtual machine deallocation. By creating an Activity Log alert rule, you can define a condition that fires when the 'Deallocate Virtual Machine' operation occurs, sending notifications via action groups to email, SMS, or webhook. This makes Azure Monitor the go-to for real-time, resource-level operational alerts.
✗Azure Service HealthWrong answer — click to see why▾
Why this is wrong here
Azure Service Health provides personalized alerts about service issues and planned maintenance, but it does not monitor individual VM deallocation events. It focuses on Azure infrastructure health, not resource-level operational data.
★ When this WOULD be the correct answer
When the question asks for a service that alerts about Azure service outages or planned maintenance affecting multiple subscriptions, Azure Service Health would be correct. For example: 'Which service provides alerts when Azure experiences a region-wide outage?'
Why candidates choose this
Candidates may confuse 'service health' with 'resource health' and assume Service Health can monitor VM deallocations, especially since it offers alerting capabilities for Azure services.
✗Azure AdvisorWrong answer — click to see why▾
Why this is wrong here
Azure Advisor provides personalized recommendations for best practices in cost, security, reliability, and performance, but it does not create alert rules for specific events like VM deallocation.
★ When this WOULD be the correct answer
Azure Advisor would be the correct answer if the question asked: 'Which Azure service provides recommendations to improve the reliability of virtual machines by suggesting availability zone configurations?'
Why candidates choose this
Candidates may confuse Advisor's proactive recommendations with monitoring and alerting capabilities, assuming it can also trigger actions on events.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy is used to enforce organizational standards and assess compliance, not to trigger alerts on specific events like VM deallocation. It cannot create alert rules based on activity logs.
★ When this WOULD be the correct answer
An exam question asks: 'A company needs to ensure that all virtual machines deployed in a subscription have a specific tag. Which Azure service should they use to enforce this requirement?' In that scenario, Azure Policy would be correct.
Why candidates choose this
Candidates may confuse Azure Policy's ability to audit and enforce configurations with monitoring and alerting capabilities, thinking it can also trigger actions on events.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Monitor
Azure Monitor is a cloud service that collects, analyzes, and acts on telemetry data from your Azure and on-premises resources to help you understand performance and availability.
Key term
Trigger
In Azure data services, a trigger is a predefined automatic action that initiates a process when a specific event occurs, such as data arriving or a schedule being met.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.