AZ-104 practice question 9 of 35

You have an Azure virtual machine named VM1 that runs Windows Server 2016. You need to create an alert in Azure when more than two error events are…

Domain Manage Azure identities and governance

You have an Azure virtual machine named VM1 that runs Windows Server 2016. You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour. Solution: You create an Azure storage account and conﬁgure shared access signatures (SASs). You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the storage account as the source. Does that meet the goal?

Answer options

A: Yes

B: No Correct answer

Correct Answer:

B. No

Explanation

The proposed solution is incorrect because Azure Monitor log alerts cannot use an Azure storage account as a direct data source for querying and triggering. To create an alert based on Windows Event Log entries, the data must first be sent to a Log Analytics workspace. The Microsoft Monitoring Agent should be configured to collect the System event log and forward it to a Log Analytics workspace. Subsequently, a log alert rule is created in Azure Monitor that targets the workspace and uses a Kusto Query Language (KQL) query to count the specific error events within the defined time frame.

Why Incorrect

A. Yes: This is incorrect because specifying a storage account as the source for a log alert rule is not a supported configuration. Alert rules query data from Log Analytics workspaces or Application Insights, not storage blobs.

References

1. Microsoft Learn

Tutorial - Create a log query alert for an Azure resource: This official tutorial details the process of creating a log alert rule. In Step 5 of the "Create a new log alert rule" section

it explicitly states

"The scope defines the resources that the alert rule can be based on. For this tutorial

set the scope to the Log Analytics workspace you created earlier." This confirms the Log Analytics workspace is the required source.

Source: Microsoft Learn

"Tutorial: Create a log query alert for an Azure resource"

Section: "Create a new log alert rule".

2. Microsoft Learn

Collect event and performance counters from virtual machines with Log Analytics agent: This document describes how to configure data collection from VMs. It states

"The Log Analytics agent for Windows and Linux collects events from the Windows event log... After you install the agent

you connect it to one or more workspaces... On the Windows Event Logs tab

add the names of the logs to collect." This shows the correct data flow is from the agent to a Log Analytics workspace.

Source: Microsoft Learn

"Collect event and performance counters from virtual machines with Log Analytics agent"

Section: "Configure data sources".

3. Microsoft Learn

Log alerts in Azure Monitor: This document provides an overview of log alerts. Under the "Data source" section

it specifies

"Log alerts can query data in a Log Analytics workspace or an Application Insights resource." It makes no mention of Azure Storage as a valid data source for log alert queries.

Source: Microsoft Learn

"Log alerts in Azure Monitor"

Section: "How log alerts work".

Question breakdown

Tests: Configure alerts and log collection in Azure Monitor
Difficulty: Medium

Key idea: Alerts based on Windows event log content require the events to be sent to a Log Analytics workspace and queried with a log search alert rule.

How to reach the answer

The goal is to count error events in the System log over a one-hour window, which is a log query condition.
Log search alerts in Azure Monitor run KQL against a Log Analytics workspace, not against a storage account.
The agent (MMA, or now AMA with a data collection rule) must send events to a workspace.
Clue: the solution names a storage account with SAS as the alert source, which is not a valid source for this kind of alert, so the answer is No.

Each option

AIncorrect. An Azure Monitor alert cannot use a storage account with SAS to count event log entries.
BCorrect. The design lacks a Log Analytics workspace and log search alert, so it cannot alert on the event count.

Common trap: Storage accounts can hold diagnostic data, so it seems plausible that alerts could read from them, but alert rules query workspaces, not blobs or tables.

In practice: Admins monitoring VM event logs usually set up a data collection rule that sends Windows events to a Log Analytics workspace. They then create a log search alert with a count threshold and an evaluation window.

Remember: Event-log-based alerting means workspace plus agent plus log search alert; storage accounts are for archiving, not alert sources.

Official documentation: Azure Monitor Agent overview · What are Azure Monitor alerts?

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free AZ-104 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test