AZ-104 practice question 9 of 35

You have an Azure virtual machine named VM1 that runs Windows Server 2016. You need to create an alert in Azure when more than two error events are…

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Manage Azure identities and governance

You have an Azure virtual machine named VM1 that runs Windows Server 2016. You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour. Solution: You create an Azure storage account and conﬁgure shared access signatures (SASs). You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the storage account as the source. Does that meet the goal?

Answer options

Correct Answer:

Explanation

The proposed solution will not meet the goal. While the Microsoft Monitoring Agent (MMA)

can collect Windows Event Logs and can be conﬁgured to send data to an Azure Storage

account, Azure Monitor alerts for speciﬁc event log content (like counting error events) are

typically based on queries against a Log Analytics workspace. Azure Monitor cannot directly

query the detailed content of event logs stored as ﬁles/blobs in an Azure Storage account to

count speciﬁc event types within a time window for alerting purposes. A Log Analytics

workspace is required to ingest, analyze, and enable querying of these logs for such alert

conditions.

References

1. Overview of Azure Monitor agents: "The Log Analytics agent, also known as the

Microsoft Monitoring Agent (MMA), collects monitoring data from the guest operating

system of Azure and hybrid virtual machines and sends it to a Log Analytics workspace."

While it can also send to Azure Storage, the primary path for analysis and alerting is Log

Analytics.

Microsoft Learn. (2024). Overview of Azure Monitor agents. Retrieved from

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview

2. Collect Windows event log data sources with Log Analytics agent in Azure Monitor:

"Azure Monitor can collect events from the Windows event log from Windows agents... You

conﬁgure collection of Windows events from the Agents conﬁguration menu for the Log

Analytics workspace... You can then create log query alerts to be notiﬁed when a particular

event is collected." This clearly indicates Log Analytics workspace as the destination for

event logs intended for alerting.

Microsoft Learn. (2024). Collect Windows event log data sources with Log Analytics agent

in Azure Monitor. Retrieved from https://learn.microsoft.com/en-us/azure/azuremonitor/agents/data-sources-windows-events

3. Log query alerts in Azure Monitor: "Log alerts allow users to use a Log Analytics query to

evaluate resources logs at a set frequency, and ﬁre an alert based on the results." The

target for these queries is a Log Analytics workspace or Application Insights.

Microsoft Learn. (2024). Log query alerts in Azure Monitor. Retrieved from

https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-log

Question 9 of 35

Question breakdown

Tests: Configure alerts and log collection in Azure Monitor
Difficulty: Medium

Key idea: Alerts based on Windows event log content require the events to be sent to a Log Analytics workspace and queried with a log search alert rule.

How to reach the answer

The goal is to count error events in the System log over a one-hour window, which is a log query condition.
Log search alerts in Azure Monitor run KQL against a Log Analytics workspace, not against a storage account.
The agent (MMA, or now AMA with a data collection rule) must send events to a workspace.
Clue: the solution names a storage account with SAS as the alert source, which is not a valid source for this kind of alert, so the answer is No.

Each option

AIncorrect. An Azure Monitor alert cannot use a storage account with SAS to count event log entries.
BCorrect. The design lacks a Log Analytics workspace and log search alert, so it cannot alert on the event count.

Common trap: Storage accounts can hold diagnostic data, so it seems plausible that alerts could read from them, but alert rules query workspaces, not blobs or tables.

In practice: Admins monitoring VM event logs usually set up a data collection rule that sends Windows events to a Log Analytics workspace. They then create a log search alert with a count threshold and an evaluation window.

Remember: Event-log-based alerting means workspace plus agent plus log search alert; storage accounts are for archiving, not alert sources.

Official documentation: Azure Monitor Agent overview · What are Azure Monitor alerts?

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free AZ-104 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test