Microsoft AZ-104 Exam Dumps, Practice Test Questions

A dimension filter selects a metric time series, but does not lengthen the lookback or require sustained CPU elevation. Configure the appropriate aggregation and evaluation window for the CPU condition.

A threshold changes the measured level that must be exceeded, not the length of time the condition must persist. A momentary spike might still cross a higher threshold. Tune aggregation/window settings to capture sustained high usage.

More frequent evaluation checks the same condition more often and does not by itself filter one-minute spikes. Use a suitable longer window and aggregation strategy rather than confusing polling frequency with sustained-duration evaluation.

Dynamic thresholds learn historical behavior rather than treating a single observation as an established baseline. Assuming immediate anomaly decisions during the first sample contradicts the documented initialization minimum and could lead the operations team to diagnose a working alert configuration incorrectly.

A one-day aggregation window changes how samples are summarized; it does not manufacture the historical days and sample count needed to establish a dynamic threshold. Microsoft documents a minimum learning history before alerts can trigger, so the operations team cannot solve the cold start merely by expanding the aggregation window.

Static thresholds may be appropriate for immediate detection during a learning period, but switching permanently is not the technical prerequisite for dynamic thresholds. A supplementary static alert can cover initial rollout while the supported dynamic rule gathers enough history.

Testing one receiver does not prove the second receiver can be invoked or accepted by its endpoint. Test the applicable action-group receiver types and inspect the actual status or response details for both email and webhook.

A manual message may show that an inbox is reachable, but it does not exercise the Azure Monitor action group's webhook delivery path or receiver configuration. The Test action can send controlled sample notifications and expose status for the supported receiver types.

Resource tags are metadata and aren't automatically consumed by Azure Monitor as a notification test harness. Adding them does not send a sample payload to the configured email or webhook receivers and cannot verify their operation.

The write operation identifies a create/update activity, not the administrative delete event. For deletion notifications, match the corresponding networkSecurityGroups/delete operation and scope in an Activity Log alert.

A KQL alert cannot match NSG deletion operations if the chosen workspace has no management-plane event records to query.

Resource Health indicates supported platform availability conditions; it is not the direct signal for an administrator deleting an ARM NSG resource.

An Activity Log metric for administrative operations cannot count failed Entra sign-ins by one identity over ten minutes. The alert needs a KQL query filtering failures and grouping by user and time window.

The requested threshold is based on failed sign-in rows for the same user, not an individual Azure Resource Manager activity event. Use a log search alert with the appropriate filter and aggregation.

The desired incident is 15 failures by the same user in ten minutes; counting successes or different users would produce incorrect alerts.

Resource Health concerns an individual resource state; it does not replace a Service Health alert for provider incidents affecting many services or regions.

One URL probe may notice a symptom but does not identify Microsoft-reported subscription-impacting service incidents across selected regions.

CPU thresholds report resource performance rather than Azure platform health communications about regional service incidents.

A new cross-VM log query would test an aggregate or custom computation rather than describe how the existing multi-resource metric alert evaluates its targets.

A multi-resource metric rule does not apply an implicit all-resources logical AND. One VM breaching independently can trigger its own alert instance.

Log search alerts use different queries and evaluation semantics. Converting the rule does not explain the separate evaluation of the current metric alert.

Metric dimensions partition observations; they are not action-routing destinations. They cannot invoke an automated workflow on the alert.

Resource tags describe or organize resources; alerting does not execute tag values as automation targets. The invocation must be configured as an alert action.

Policy evaluation acts on resource compliance; it is not the action path for an Azure Monitor metric alert. The existing rule should retain its metric condition and call an action group.

Service Health describes broader platform incidents; individual VM availability calls for Resource Health conditions.

CPU measurements are not equivalent to the VM's Resource Health availability or platform-initiated degradation signal.

Service Health signals broader service incidents, not every individual VM's availability transition. Use Resource Health conditions for the specific VM resource.

Stateless alerts can fire at every evaluation where the condition remains true, creating the repeated paging the team wants to avoid.

Stopping evaluation discards useful monitoring and cannot reliably detect recovery or a later recurrence of the threshold condition.

Suppressing all actions would hide even new breaches. Stateful alert behavior solves repeat actions while retaining meaningful notifications on later state changes.

A standard Webhook is intended for generic HTTP endpoints and basic-auth credentials may be supplied through its URI, but that does not satisfy a Microsoft Entra-protected API expecting token-based identity. Embedding secrets in URLs also creates an avoidable exposure path. The scenario explicitly requires Entra authentication rather than basic authentication.

An Azure Logic App can implement a secured API call when its connector, managed identity, or OAuth flow is explicitly configured. The action-group trigger alone supplies no Entra access token accepted by the protected API, whereas Secure webhook is the direct Entra-authenticated action type described in this scenario.

An Azure Functions trigger key may authorize calling that function but is not a Microsoft Entra bearer token for the company API. The function would need its own explicitly implemented protected-API authentication logic; Secure webhook provides the supported direct action-group integration.