Hotspot Question You have an Azure subscription that contains an Azure Storage account named storage1 and the users shown in the following table. You plan to monitor storage1 and to configure email…

Question

Exhibits

Answer Area

• Alert rules:
  1234
• Action groups:
  1234

Explanation

To monitor four distinct signals with varying notification requirements, a minimum of four alert rules are needed due to different alert types and notification targets, while three unique action groups suffice for the distinct user notification sets.

Approach. The core concept to understand is that Azure Monitor alert rules define when an alert should fire based on a signal, and action groups define what happens when an alert fires (i.e., who gets notified). The question asks for the minimum number of each.

Alert Rules Analysis:

1. Signal Types: Azure Monitor differentiates between Metric alerts and Activity Log alerts. These cannot be combined into a single alert rule. Thus, we will need at least two rules: one for metrics and one for activity logs.
2. Metric Signals: 'Ingress' and 'Egress' are both Metric signals for the same storage account. However, they require different users to be notified ('User1 and User3' vs. 'User1'). While it's possible for an advanced metric alert rule to have multiple conditions, if those conditions lead to different action group requirements, they typically require separate alert rules for simplicity and to correctly map distinct notification groups. Therefore, it's best to configure two separate metric alert rules: one for Ingress and one for Egress.
3. Activity Log Signals: 'Delete storage account' and 'Restore blob ranges' are both Activity Log signals. Similarly, they require different users to be notified ('User1, User2, and User3' vs. 'User1 and User3'). Although an activity log alert can use a Kusto Query Language (KQL) query to monitor multiple operations, the differing notification requirements make separate rules the most straightforward and 'minimum' for distinct actions. Thus, two separate activity log alert rules are needed: one for 'Delete storage account' and one for 'Restore blob ranges'.
4. Total Alert Rules: 2 (Metric rules) + 2 (Activity Log rules) = 4 alert rules.

Action Groups Analysis: Action groups define the unique sets of recipients for notifications. We need to identify how many distinct groups of users are required:

1. 'User1 and User3' (for Ingress and Restore blob ranges) - This is one unique action group.
2. 'User1 only' (for Egress) - This is a second unique action group.
3. 'User1, User2, and User3' (for Delete storage account) - This is a third unique action group. Since there are three distinct sets of users to notify, a minimum of 3 action groups are required. Each of these action groups can then be linked to the appropriate alert rules.

Therefore, the correct interaction is to select '4' for 'Alert rules:' and '3' for 'Action groups:'.

Common mistakes.

• common_mistake. Common mistakes include trying to combine different alert types (e.g., metric and activity log) into a single rule, which is not supported in Azure Monitor. Another mistake is to combine multiple metric or activity log conditions into one rule when the notification targets (action groups) are different. While some complex rules can monitor multiple aspects, if distinct notifications are required, separate rules often become necessary or are the simplest minimum approach. Conversely, creating a new action group for every single alert (leading to 4 action groups) rather than reusing action groups for identical notification requirements ('User1 and User3' is needed twice) would also be incorrect, as the question asks for the minimum number. For instance, selecting '2' for alert rules by trying to combine all metrics into one rule and all activity logs into another, or '4' for action groups by not reusing the 'User1 and User3' group, would be incorrect.

Concept tested. The underlying technical concept being tested is the understanding of Azure Monitor's alerting capabilities, specifically the distinction between Alert Rules (which define monitoring conditions and triggers) and Action Groups (which define notification recipients and actions). It also tests the ability to determine the minimum required resources by identifying distinct monitoring types, unique conditions, and unique notification recipient groups.

Reference. https://docs.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview, https://docs.microsoft.com/en-us/azure/azure-monitor/alerts/action-groups

No community discussion yet for this question.