Pass Your Microsoft AZ-104 Exam Easy!

Action groups define how notifications are delivered AFTER an alert rule fires; changing email recipients does not affect the CPU metric's numerical threshold, aggregation period or evaluation frequency. Here no alert instance was created despite an intended one-minute spike, so the first problem lies in the rule's evaluation or metric series, not delivery to the on-call team. Review the stored metric samples and the rule's condition configuration. Only after the condition is observed firing should the team test an action group's notification channels. Editing recipients before identifying the evaluation failure would not restore the intended detection.

'Define the threshold in the alert rule and recipients in the action group' solves another task because action group configuration handles response delivery, not the measured alert condition. For the situation where an alert evaluated a VM's CPU but did not fire despite a one-minute spike, this distractor misses the requirement that an alert condition may need multiple samples or an aggregate, not an isolated measurement. Unlike 'Define the threshold in the alert rule and recipients in the action group', 'Check the configured aggregation window, threshold and evaluation frequency' directly targets that requirement; its success must be confirmed at the authorized resource scope.

A five-minute average intentionally hides many one-minute CPU excursions by combining the high sample with lower values. That might be appropriate for a separate alert designed to ignore transient spikes, but it directly contradicts the current requirement to fire on an isolated one-minute 95% reading. This option changes the monitoring objective rather than investigating the mismatch. Review aggregation type, period, evaluation frequency, dimensions and measured series to understand why the enabled rule never fired, and then configure the intended short-window evaluation rather than quietly suppressing the event.

An alert processing rule modifies notification behavior after an alert is evaluated, such as suppressing action groups during maintenance windows. It does not grant permission to select a separately owned action group while creating an alert rule. The author is denied at the referenced action group's resource scope, so a processing rule does not repair that authorization failure. Microsoft documents read access to the referenced action group, read on the monitored target, and write at the resource group where the alert rule is created. Verify the missing cross-scope read grant before retrying the rule.

Attaching an existing action group and testing its email, webhook or other delivery channels is appropriate only after the author is authorized to reference that action-group resource. The case reports a permission failure at the action group's different scope, not a delivery failure or missing receiver configuration. Simply reselecting the same group or triggering a test will not grant Azure RBAC permissions. Confirm read access to the referenced group along with alert-rule target/read and destination resource-group/write permissions, then test notification delivery once the rule can be saved.

Creating a metric alert with a sensible aggregation window is a distinct task from granting access to an action group owned in another resource group. Even a perfectly chosen CPU threshold or evaluation interval does not bypass permission checks when the rule author selects that action-group resource. The relevant Microsoft documented requirements concern alert target read access, the alert-rule resource-group write action, and read permission on any referenced action group. Fix the missing access at the action group's scope rather than changing the metric evaluation design or the monitored signal.

An alert rule determines when the metric or log condition is met, while an action group determines the notification or automation actions after firing. That division of responsibilities remains true here, but it does not explain the denial when the author tries to reference an action group in a separate resource group. Reading and selecting the existing group requires the appropriate cross-scope RBAC read permission; editing its recipients requires additional management permissions and is not requested. Inspect the referenced action group and the author's effective grants, then retry the alert rule without changing thresholds.

'Verify collection timestamps and fresh telemetry arrival' solves another task because a stale visualization is not current evidence that a workload recovered. For the situation where a VM has erratic guest performance but only basic platform CPU metrics are collected, this distractor misses the requirement that guest process and performance diagnostics may require supported agents and data collection rules. Unlike 'Verify collection timestamps and fresh telemetry arrival', 'Enable suitable VM Insights/agent-based collection for deeper host telemetry' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a VM Insights workbook displays missing guest metrics after an agent migration, the action 'Check Azure Monitor Agent and applicable data collection rule associations' can be relevant: dashboard layout is not proof the required agent is emitting the expected data streams. For the different problem of a VM has erratic guest performance but only basic platform CPU metrics are collected, 'Check Azure Monitor Agent and applicable data collection rule associations' misses the mechanism that guest process and performance diagnostics may require supported agents and data collection rules. Choosing 'Check Azure Monitor Agent and applicable data collection rule associations' would address that other need, whereas 'Enable suitable VM Insights/agent-based collection for deeper host telemetry' is intended to solve the stated condition.

'Check whether source agents and required telemetry are present before trusting topology completeness' applies to a different feature boundary because missing instrumentation can create blind spots without proving network nodes disappeared. In the stated scenario where a VM has erratic guest performance but only basic platform CPU metrics are collected, 'Check whether source agents and required telemetry are present before trusting topology completeness' does not satisfy the mechanism that guest process and performance diagnostics may require supported agents and data collection rules. The necessary action is 'Enable suitable VM Insights/agent-based collection for deeper host telemetry', which should be checked against this Azure resource's actual permissions and state.

A workbook presents already collected telemetry; refreshing its visual display cannot generate guest metrics missing after an agent migration. Azure Monitor Agent and data collection rule associations govern the supported collection path. Verify the active agent, rule scope, target workspace and ingestion before trusting the workbook. A visualization-only change would leave the source instrumentation problem untouched.

The nearby action 'Check whether source agents and required telemetry are present before trusting topology completeness' is associated with this separate need: a topology dashboard omits one VM after its monitoring agent was removed. That is because missing instrumentation can create blind spots without proving network nodes disappeared. Here a VM Insights workbook displays missing guest metrics after an agent migration, so 'Check whether source agents and required telemetry are present before trusting topology completeness' misses the fact that dashboard layout is not proof the required agent is emitting the expected data streams. 'Check Azure Monitor Agent and applicable data collection rule associations' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Use a scoped Azure Monitor workbook or metric dimensions for per-account failures' solves another task because resource-specific views expose concentrated errors hidden by fleet aggregates. For the situation where a VM Insights workbook displays missing guest metrics after an agent migration, this distractor misses the requirement that dashboard layout is not proof the required agent is emitting the expected data streams. Unlike 'Use a scoped Azure Monitor workbook or metric dimensions for per-account failures', 'Check Azure Monitor Agent and applicable data collection rule associations' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Capacity metrics indicate storage consumption, not whether packets from the named VM can reach the destination's TCP port. Filtering by storage account cannot identify the source and destination addresses, matching NSG rule, user-defined route, or reachability failure of the network flow. The case already shows a failed connection across two private subnets, and the engineer needs a one-time network-path diagnosis. Use Network Watcher Connection Troubleshoot with the actual endpoints instead of trying to interpret an unrelated capacity time series as network telemetry.

Microsoft Network Watcher Connection Monitor can also test TCP reachability and supports ongoing source-to-destination measurements. But the case expressly requires a one-time investigation now without creating a continuous monitoring resource or test group. Deploying a persistent monitor may be appropriate for recurring service-level observability, yet it adds configuration and long-running collection that the operator has ruled out. Connection Troubleshoot provides the targeted immediate reachability and path diagnostic without redefining the task as a standing monitor, so this alternative fails the specified operating constraint.

Testing end-user HTTP transactions after connectivity is restored is valuable application validation, but it cannot explain the immediate failure to establish a TCP session to the target port. Before application response analysis is meaningful, the engineer must determine whether the required IP path, route, NSG or listener allows connection setup. The storage capacity chart does not answer that question either. Run a targeted source/destination/port Connection Troubleshoot diagnostic now, and use later HTTP or transaction tests to confirm the overall service recovered.

The nearby action 'Use network reachability and connection diagnostics for packet-path failures' is associated with this separate need: a Network team uses a storage capacity chart to explain failed TCP connectivity between subnets. That is because Storage occupancy and transport reachability are distinct measurements and tools. Here Storage transactions fail mostly on one account while aggregate metrics look healthy, so 'Use network reachability and connection diagnostics for packet-path failures' misses the fact that resource-specific views expose concentrated errors hidden by fleet aggregates. 'Use a scoped Azure Monitor workbook or metric dimensions for per-account failures' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Check Azure Monitor Agent and applicable data collection rule associations' solves another task because dashboard layout is not proof the required agent is emitting the expected data streams. For the situation where Storage transactions fail mostly on one account while aggregate metrics look healthy, this distractor misses the requirement that resource-specific views expose concentrated errors hidden by fleet aggregates. Unlike 'Check Azure Monitor Agent and applicable data collection rule associations', 'Use a scoped Azure Monitor workbook or metric dimensions for per-account failures' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an Insights dashboard shows yesterday's healthy state after today's failed deployment, the action 'Verify collection timestamps and fresh telemetry arrival' can be relevant: a stale visualization is not current evidence that a workload recovered. For the different problem of Storage transactions fail mostly on one account while aggregate metrics look healthy, 'Verify collection timestamps and fresh telemetry arrival' misses the mechanism that resource-specific views expose concentrated errors hidden by fleet aggregates. Choosing 'Verify collection timestamps and fresh telemetry arrival' would address that other need, whereas 'Use a scoped Azure Monitor workbook or metric dimensions for per-account failures' is intended to solve the stated condition.

Microsoft has deprecated the legacy VM Insights dependency Map and advises against fresh Dependency Agent installations on new systems. Reinstalling the agent everywhere as a standard future onboarding strategy conflicts with that guidance and does not explain the trust boundary of an already incomplete view. The administrator needs to disclose that the dashboard reflects collected process and dependency telemetry, not every VM by default, and plan migration to supported monitoring methods rather than using a retiring component as a comprehensive inventory source.

Azure Monitor Agent can provide important counters and logs, but dependency mapping additionally requires process/dependency telemetry that may not be present after the relevant agent is removed. A healthy performance counter or VM heartbeat does not prove the deprecated Map feature is currently receiving the same dependency data as before. The observed missing VM is consistent with a collection blind spot, not definitive deletion from Azure. Verify the actual source of map data and use supported resource inventory/monitoring methods for complete reporting.

A cached map can display old connections and still be missing machines whose telemetry stopped, so timestamp-free trust would conflate historical observation with current topology. The question states an agent was removed before the VM disappeared from the map, making current telemetry availability the key limitation to disclose. Check that data is fresh and complete, and avoid presenting the legacy map as a live, authoritative network inventory. For new deployments, follow Microsoft's replacement guidance for the deprecated Map feature.

'Enable suitable VM Insights/agent-based collection for deeper host telemetry' applies to a different feature boundary because guest process and performance diagnostics may require supported agents and data collection rules. In the stated scenario where an Insights dashboard shows yesterday's healthy state after today's failed deployment, 'Enable suitable VM Insights/agent-based collection for deeper host telemetry' does not satisfy the mechanism that a stale visualization is not current evidence that a workload recovered. The necessary action is 'Verify collection timestamps and fresh telemetry arrival', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Check whether source agents and required telemetry are present before trusting topology completeness' is associated with this separate need: a topology dashboard omits one VM after its monitoring agent was removed. That is because missing instrumentation can create blind spots without proving network nodes disappeared. Here an Insights dashboard shows yesterday's healthy state after today's failed deployment, so 'Check whether source agents and required telemetry are present before trusting topology completeness' misses the fact that a stale visualization is not current evidence that a workload recovered. 'Verify collection timestamps and fresh telemetry arrival' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Check Azure Monitor Agent and applicable data collection rule associations' solves another task because dashboard layout is not proof the required agent is emitting the expected data streams. For the situation where an Insights dashboard shows yesterday's healthy state after today's failed deployment, this distractor misses the requirement that a stale visualization is not current evidence that a workload recovered. Unlike 'Check Azure Monitor Agent and applicable data collection rule associations', 'Verify collection timestamps and fresh telemetry arrival' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Inspecting a failed test group is appropriate after an existing Connection Monitor reports trouble, but the scenario asks the team to establish recurring tests in the first place. A source-to-destination schedule with known protocol and thresholds must exist before historical failures can be investigated meaningfully. The source is an instrumented Azure VM and the target is a partner API FQDN, both supported endpoints for Connection Monitor. Configure a test group and HTTP/TCP test settings first; then use its logs and metrics to troubleshoot errors, latency, or changes to network connectivity over time.

A platform metric collected from a resource is passive observation of that resource, not an active HTTP or TCP probe originating from the team’s specified Azure VM. The external partner endpoint may not even publish metrics into the customer’s Azure Monitor subscription. The requirement is to test reachability and latency from a controlled source region at regular intervals. Network Watcher Connection Monitor supports Azure VM source endpoints with a monitoring extension, URL/FQDN destinations, protocol-specific test configurations and scheduled measurements. Relying only on a generic aggregate metric would not reproduce the intended source-to-partner network path.

An application-level functional test after a repair can show whether a workflow has recovered, but the question is about continuously measuring the path before incidents occur. A one-time post-recovery validation provides no schedule, trend, alerting or baseline for the regional source VM. It also need not include the protocol-appropriate connection checks requested here. Connection Monitor creates recurring HTTP/TCP tests between its instrumented source endpoint and selected partner FQDN, and can publish observed reachability and latency. End-to-end application tests may supplement this monitoring when semantic API correctness is also a business requirement.

Network Watcher connection troubleshooting can diagnose a particular failure on demand, but one snapshot measurement is not the same as scheduled reachability monitoring. The team requests regular tests originating from one instrumented Azure VM to a partner API hostname, with historical results that can be compared or alerted upon. Connection Monitor provides defined test groups, test frequency, accepted HTTP responses or TCP connection checks, and logs/metrics for changes over time. Use an ad hoc diagnostic after the recurring monitor identifies a problem, rather than pretending an isolated troubleshooting command supplies continuous observation.

Network connection diagnostics can test whether a route or port is reachable and help identify failures, but they are not the capture-scoping configuration the team needs after an actual packet trace proved too broad. The question states a packet capture already exists and includes unrelated traffic. The admin should filter the next Network Watcher packet capture by relevant endpoints, ports or protocols and bound its duration, while retaining sufficient payload and timestamps for later analysis. Replacing this with a general reachability check does not create the requested focused trace.

A successful application-level transaction test is useful after network remediation, but the present concern is collecting a smaller, high-signal packet trace during an intermittent failure. Generic application validation will not limit the packet capture's volume or isolate traffic for a particular five-tuple. Adjust the Network Watcher capture filters, maximum duration and relevant VM capture context, then verify the recorded traffic corresponds to the failed session. Once the network cause is addressed, application tests may confirm recovery as a separate task.

Inspecting source and destination connectivity is a useful first investigation step, but a broad trace was already collected and the question now asks which capture configuration directly reduces unrelated packet volume. The Network Watcher packet capture settings can restrict packet collection to the VM and traffic filters relevant to the failing application while keeping enough time to observe intermittent failures. A general network-path review alone will not impose any limit on the next PCAP. Capture filtering and a bounded duration provide the requested diagnostic control.

'Use Azure Network Watcher packet capture with scoped duration/filters' solves another task because packet capture records traffic for targeted diagnosis; it is not a continuously running blanket audit. For the situation where a VM service port is denied despite its apparent NSG configuration, this distractor misses the requirement that individual rule lists can miss inherited subnet/NIC combinations and precedence. Unlike 'Use Azure Network Watcher packet capture with scoped duration/filters', 'Read effective NSG security rules and match the blocked five-tuple' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a route change is applied and network tests pass, so operations claim every application is healthy, the action 'Validate application-level transactions and dependencies after network recovery' can be relevant: a working route proves path reachability, not database, auth or application correctness. For the different problem of a VM service port is denied despite its apparent NSG configuration, 'Validate application-level transactions and dependencies after network recovery' misses the mechanism that individual rule lists can miss inherited subnet/NIC combinations and precedence. Choosing 'Validate application-level transactions and dependencies after network recovery' would address that other need, whereas 'Read effective NSG security rules and match the blocked five-tuple' is intended to solve the stated condition.

'Resolve DNS/name configuration separately from routing next-hop status' applies to a different feature boundary because correct routes do not make a missing DNS record resolve to an IP address. In the stated scenario where a VM service port is denied despite its apparent NSG configuration, 'Resolve DNS/name configuration separately from routing next-hop status' does not satisfy the mechanism that individual rule lists can miss inherited subnet/NIC combinations and precedence. The necessary action is 'Read effective NSG security rules and match the blocked five-tuple', which should be checked against this Azure resource's actual permissions and state.