resource log export is controlled by diagnostic settings and their selected categories and destinations. In this case, an administrator wants to send activity log events to a shared analytics workspace. “The storage diagnostic settings for the required resource-log categories” would not satisfy that requirement; the supported action is “An activity log diagnostic setting with Log Analytics destination”. Diagnostic settings can stream Azure activity events to a supported destination for investigation.

logs support event-level queries that aggregate counters alone cannot reconstruct. In this case, an administrator wants to send activity log events to a shared analytics workspace. “Diagnostic or application logs collected to a Log Analytics workspace” would not satisfy that requirement; the supported action is “An activity log diagnostic setting with Log Analytics destination”. Diagnostic settings can stream Azure activity events to a supported destination for investigation.

the Activity Log records supported subscription-level management-plane operations. In this case, an administrator wants to send activity log events to a shared analytics workspace. “Azure Activity Log administrative events for the subscription” would not satisfy that requirement; the supported action is “An activity log diagnostic setting with Log Analytics destination”. Diagnostic settings can stream Azure activity events to a supported destination for investigation.

diagnostic settings can stream Azure activity events to a supported destination for investigation. In this case, a storage account resource log is not appearing in the organization's centralized workspace. “An activity log diagnostic setting with Log Analytics destination” would not satisfy that requirement; the supported action is “The storage diagnostic settings for the required resource-log categories”. Resource log export is controlled by diagnostic settings and their selected categories and destinations.

logs support event-level queries that aggregate counters alone cannot reconstruct. In this case, a storage account resource log is not appearing in the organization's centralized workspace. “Diagnostic or application logs collected to a Log Analytics workspace” would not satisfy that requirement; the supported action is “The storage diagnostic settings for the required resource-log categories”. Resource log export is controlled by diagnostic settings and their selected categories and destinations.

workspace/table retention policies determine how long collected logs remain available. In this case, a storage account resource log is not appearing in the organization's centralized workspace. “Log Analytics data retention settings and any supported archive options” would not satisfy that requirement; the supported action is “The storage diagnostic settings for the required resource-log categories”. Resource log export is controlled by diagnostic settings and their selected categories and destinations.

diagnostic settings can stream Azure activity events to a supported destination for investigation. In this case, a governance team needs to trace who changed a resource's configuration. “An activity log diagnostic setting with Log Analytics destination” would not satisfy that requirement; the supported action is “Azure Activity Log administrative events for the subscription”. The Activity Log records supported subscription-level management-plane operations.

resource log export is controlled by diagnostic settings and their selected categories and destinations. In this case, a governance team needs to trace who changed a resource's configuration. “The storage diagnostic settings for the required resource-log categories” would not satisfy that requirement; the supported action is “Azure Activity Log administrative events for the subscription”. The Activity Log records supported subscription-level management-plane operations.

kQL grouping and time filters produce per-resource counts from collected events. In this case, a governance team needs to trace who changed a resource's configuration. “A KQL aggregation over relevant records in Log Analytics” would not satisfy that requirement; the supported action is “Azure Activity Log administrative events for the subscription”. The Activity Log records supported subscription-level management-plane operations.

diagnostic settings can stream Azure activity events to a supported destination for investigation. In this case, an operations analyst needs to summarize errors by resource over the last hour. “An activity log diagnostic setting with Log Analytics destination” would not satisfy that requirement; the supported action is “A KQL aggregation over relevant records in Log Analytics”. KQL grouping and time filters produce per-resource counts from collected events.

logs support event-level queries that aggregate counters alone cannot reconstruct. In this case, an operations analyst needs to summarize errors by resource over the last hour. “Diagnostic or application logs collected to a Log Analytics workspace” would not satisfy that requirement; the supported action is “A KQL aggregation over relevant records in Log Analytics”. KQL grouping and time filters produce per-resource counts from collected events.

workspace/table retention policies determine how long collected logs remain available. In this case, an operations analyst needs to summarize errors by resource over the last hour. “Log Analytics data retention settings and any supported archive options” would not satisfy that requirement; the supported action is “A KQL aggregation over relevant records in Log Analytics”. KQL grouping and time filters produce per-resource counts from collected events.

diagnostic settings can stream Azure activity events to a supported destination for investigation. In this case, a monitoring team must retain logs beyond the workspace's current retention. “An activity log diagnostic setting with Log Analytics destination” would not satisfy that requirement; the supported action is “Log Analytics data retention settings and any supported archive options”. Workspace/table retention policies determine how long collected logs remain available.

resource log export is controlled by diagnostic settings and their selected categories and destinations. In this case, a monitoring team must retain logs beyond the workspace's current retention. “The storage diagnostic settings for the required resource-log categories” would not satisfy that requirement; the supported action is “Log Analytics data retention settings and any supported archive options”. Workspace/table retention policies determine how long collected logs remain available.

kQL grouping and time filters produce per-resource counts from collected events. In this case, a monitoring team must retain logs beyond the workspace's current retention. “A KQL aggregation over relevant records in Log Analytics” would not satisfy that requirement; the supported action is “Log Analytics data retention settings and any supported archive options”. Workspace/table retention policies determine how long collected logs remain available.

alert sensitivity depends on its time window and aggregation, not only the metric name. In this case, an operator wants an alert when VM CPU exceeds a threshold over several samples. “Alert aggregation window, evaluation frequency and threshold” would not satisfy that requirement; the supported action is “An Azure Monitor metric alert with an appropriate aggregation and threshold”. Metric alerts evaluate numeric resource time-series against configured criteria.

log alerts evaluate query results rather than fixed platform metric thresholds. In this case, an operator wants an alert when VM CPU exceeds a threshold over several samples. “A scheduled log query alert using KQL” would not satisfy that requirement; the supported action is “An Azure Monitor metric alert with an appropriate aggregation and threshold”. Metric alerts evaluate numeric resource time-series against configured criteria.

action groups define reusable receivers/actions invoked by alert rules. In this case, an operator wants an alert when VM CPU exceeds a threshold over several samples. “An Azure Monitor action group containing the desired notification actions” would not satisfy that requirement; the supported action is “An Azure Monitor metric alert with an appropriate aggregation and threshold”. Metric alerts evaluate numeric resource time-series against configured criteria.

service Health alerts notify about platform service events affecting selected Azure scopes. In this case, a team wants an email and webhook when an alert fires. “A Service Health alert routed to an action group” would not satisfy that requirement; the supported action is “An Azure Monitor action group containing the desired notification actions”. Action groups define reusable receivers/actions invoked by alert rules.

metric alerts evaluate numeric resource time-series against configured criteria. In this case, a team wants an email and webhook when an alert fires. “An Azure Monitor metric alert with an appropriate aggregation and threshold” would not satisfy that requirement; the supported action is “An Azure Monitor action group containing the desired notification actions”. Action groups define reusable receivers/actions invoked by alert rules.

action groups centralize alert notification routing across multiple rules. In this case, a team wants an email and webhook when an alert fires. “Reuse an action group containing the required email/SMS/webhook receivers” would not satisfy that requirement; the supported action is “An Azure Monitor action group containing the desired notification actions”. Action groups define reusable receivers/actions invoked by alert rules.

service Health alerts notify about platform service events affecting selected Azure scopes. In this case, an Azure Monitor alert exists but never emails anyone. “A Service Health alert routed to an action group” would not satisfy that requirement; the supported action is “The action group association and its recipient configuration”. Alert evaluation and notification delivery are separate configurations.

action groups define reusable receivers/actions invoked by alert rules. In this case, an Azure Monitor alert exists but never emails anyone. “An Azure Monitor action group containing the desired notification actions” would not satisfy that requirement; the supported action is “The action group association and its recipient configuration”. Alert evaluation and notification delivery are separate configurations.

action groups centralize alert notification routing across multiple rules. In this case, an Azure Monitor alert exists but never emails anyone. “Reuse an action group containing the required email/SMS/webhook receivers” would not satisfy that requirement; the supported action is “The action group association and its recipient configuration”. Alert evaluation and notification delivery are separate configurations.

metric alerts evaluate numeric resource time-series against configured criteria. In this case, an operator wants an alert on matching error strings in collected application logs. “An Azure Monitor metric alert with an appropriate aggregation and threshold” would not satisfy that requirement; the supported action is “A scheduled log query alert using KQL”. Log alerts evaluate query results rather than fixed platform metric thresholds.

narrower query predicates prevent ordinary events from matching a security or operations alert. In this case, an operator wants an alert on matching error strings in collected application logs. “The KQL filter conditions and alert evaluation criteria” would not satisfy that requirement; the supported action is “A scheduled log query alert using KQL”. Log alerts evaluate query results rather than fixed platform metric thresholds.

service Health alerts notify about platform service events affecting selected Azure scopes. In this case, an operator wants an alert on matching error strings in collected application logs. “A Service Health alert routed to an action group” would not satisfy that requirement; the supported action is “A scheduled log query alert using KQL”. Log alerts evaluate query results rather than fixed platform metric thresholds.

narrower query predicates prevent ordinary events from matching a security or operations alert. In this case, an alert creates unnecessary noise during a planned maintenance window. “The KQL filter conditions and alert evaluation criteria” would not satisfy that requirement; the supported action is “An alert processing rule scoped to the affected resources and schedule”. Alert processing rules can modify or suppress configured alert notification behavior without deleting the alert.

alert sensitivity depends on its time window and aggregation, not only the metric name. In this case, an alert creates unnecessary noise during a planned maintenance window. “Alert aggregation window, evaluation frequency and threshold” would not satisfy that requirement; the supported action is “An alert processing rule scoped to the affected resources and schedule”. Alert processing rules can modify or suppress configured alert notification behavior without deleting the alert.

metric alerts evaluate numeric resource time-series against configured criteria. In this case, an alert creates unnecessary noise during a planned maintenance window. “An Azure Monitor metric alert with an appropriate aggregation and threshold” would not satisfy that requirement; the supported action is “An alert processing rule scoped to the affected resources and schedule”. Alert processing rules can modify or suppress configured alert notification behavior without deleting the alert.

action groups define reusable receivers/actions invoked by alert rules. In this case, an administrator wants to receive Azure Service Health communications relevant to a subscription. “An Azure Monitor action group containing the desired notification actions” would not satisfy that requirement; the supported action is “A Service Health alert routed to an action group”. Service Health alerts notify about platform service events affecting selected Azure scopes.

alert evaluation and notification delivery are separate configurations. In this case, an administrator wants to receive Azure Service Health communications relevant to a subscription. “The action group association and its recipient configuration” would not satisfy that requirement; the supported action is “A Service Health alert routed to an action group”. Service Health alerts notify about platform service events affecting selected Azure scopes.

log alerts evaluate query results rather than fixed platform metric thresholds. In this case, an administrator wants to receive Azure Service Health communications relevant to a subscription. “A scheduled log query alert using KQL” would not satisfy that requirement; the supported action is “A Service Health alert routed to an action group”. Service Health alerts notify about platform service events affecting selected Azure scopes.