Microsoft AZ-104 Exam Dumps, Practice Test Questions

A standard Webhook is intended for generic HTTP endpoints and basic-auth credentials may be supplied through its URI, but that does not satisfy a Microsoft Entra-protected API expecting token-based identity. Embedding secrets in URLs also creates an avoidable exposure path. The scenario explicitly requires Entra authentication rather than basic authentication.

An Azure Logic App can implement a secured API call when its connector, managed identity, or OAuth flow is explicitly configured. The action-group trigger alone supplies no Entra access token accepted by the protected API, whereas Secure webhook is the direct Entra-authenticated action type described in this scenario.

An Azure Functions trigger key may authorize calling that function but is not a Microsoft Entra bearer token for the company API. The function would need its own explicitly implemented protected-API authentication logic; Secure webhook provides the supported direct action-group integration.

Deleting the source alert rules stops detection and leaves a monitoring blind spot. It also requires rebuilding rules after maintenance, which is explicitly unnecessary.

A new threshold does not silence the existing alert notifications during maintenance. The original rules would still page the on-call team.

Reducing evaluation frequency can delay detection and still produce notifications. It does not express the scheduled suppression policy while preserving full alert evaluation.

Alert processing rule filters are evaluated only within the scope authorized for that rule. A description-text match cannot bypass the provider constraint that its target resources belong to the same subscription. Typing another subscription ID into a filter would not create a valid cross-subscription alert processing scope.

Moving business resources between subscriptions is not necessary merely to apply alert notification policy and may be unsupported or disruptive for some dependencies. Resource ownership and scope should remain as approved. The correct abstraction is one processing-rule resource in each of the affected subscriptions.

Disabling actual alert rules would stop condition evaluation and hide real incidents, contradicting the continuity requirement. Azure Monitor does allow an alert processing rule to cover an entire subscription, but only within the subscription where the processing rule belongs. The fix is not to abandon monitoring in Prod-B.

A shared action group may be used by alerts for unrelated workloads. Disabling it generally suppresses notifications beyond the maintained resource group, whereas an alert processing rule scoped to that group can target the intended origin without losing other production paging.

A severity-only filter is not equivalent to identifying which resources are in maintenance. It may suppress equally severe incidents from other groups; use the resource-group scope with any additional relevant filters instead.

This also silences alerts for healthy services outside maintenance, violating the requirement to preserve unrelated paging.

Changing thresholds modifies detection behavior rather than adding the on-call routing. The criteria must remain unchanged.

This disrupts the existing notification paths and does not satisfy the requirement to add a group only during specific hours.

Duplicate alerts can cause noisy double evaluation and do not maintain the single existing criterion/action configuration. A processing rule can add an action group by schedule.

Changing alert severity to critical would misclassify lower-severity events and flood the specialist team.

Removing existing action routing would silence lower-severity incidents rather than adding selective critical escalation.

An action group defines notification endpoints and actions; it does not independently provide the resource/severity matching logic requested for adding an extra action only to Sev0 incidents. A severity-filtered alert processing rule can add escalation while retaining existing routing for lower severities.

A metric threshold controls when the underlying monitor condition fires, not when an alert processing rule suppresses action groups. Changing thresholds could hide real incidents and does not move the scheduled suppression from UTC to the team’s intended time zone. The scenario states that alert evaluation should remain intact.

Deleting alert rules stops monitoring entirely and cannot be relied upon to preserve alert history or catch production incidents during maintenance. Recreating them after each window adds unnecessary risk and effort. The existing processing rule already has the correct suppression mechanism; only its schedule time zone is misconfigured.

An action group’s recipient country code is used for notification delivery, not for evaluating when an alert processing rule is active. A Sydney phone number can receive alerts regardless of schedule time zone; it does not translate a 09:00 UTC suppression window to local business hours.

Subscription scope includes the diverse compute, networking and storage alerts in that subscription. A resource-type condition must be explicitly configured or the rule can suppress notifications for unrelated resource categories.

Removing alert definitions destroys monitoring coverage and is unnecessary for scoping notification actions. The processing rule can select the relevant alerts without changing other alert rules.

Changing notification recipients on other alerts does not constrain which alerts the processing rule matches. It also mutates unrelated monitoring definitions and can leave the original broad suppression active.

Applying additional action groups has lower precedence than suppression. Even when an Apply rule adds the on-call receiver, a matching Suppress rule prevents those actions from firing.

Alert processing rules operate on fired alerts and modify notifications. Their coexistence does not cancel the alert's generation or erase the alert record from Azure Monitor.

Suppression affects action-group invocation, not the alert rule's metric threshold or severity. The alert retains its original evaluation state while notification actions are suppressed.

The alert rule name and severity are metadata, not the serialization format of the webhook body. Legacy metric, log-search and activity-log alerts can still emit different schemas even when these fields match. The common alert schema is explicitly enabled on the action-group webhook receiver, preserving existing severities.

Alert processing rules can suppress or apply action groups based on criteria, but they do not rewrite the alert notification JSON into the common alert schema. A blanket rule may even alter delivery routing. Set the useCommonAlertSchema option on the intended webhook action instead.

Sharing a URL does not normalize the JSON contracts emitted by different alert types. The endpoint would still need multiple parsers for legacy per-type schemas. Common schema is an opt-in setting per action-group receiver, so each receiver used for normalized delivery must enable it.

The stem states that automatic resolution is enabled. Azure Monitor supports stateful alerts that transition from Fired to Resolved when the metric condition has recovered for the required checks. Saying no automatic resolution exists contradicts the enabled feature and would lead the team to misdiagnose normal alert-state hysteresis.

Changing the evaluation frequency controls how often Azure Monitor evaluates the metric; it does not remove the stateful alert requirement for three consecutive evaluations in which the condition is not met. Because CPU rose again after one normal sample, the required recovery sequence was interrupted. Adjusting frequency alone is not an immediate resolution signal.

An action group controls delivery destinations and actions, not the fired versus resolved state of the metric alert condition. A receiver change might alter incident notifications but cannot substitute for the three consecutive healthy condition evaluations required for stateful auto-resolution. Investigate the actual CPU samples and alert evaluation state.