You have an Azure subscription named Sub1 that contains an Azure Log Analytics workspace named LAW1. You have 100 on-premises servers that run Windows Server 2012 R2 and Windows Server 2016. The…

Question

Options

• ALog
• BLog (Saved Query)
• CMetric
• DActivity Log

• A
  5% (2)
• B
  5% (2)
• C
  76% (28)
• D
  14% (5)

Explanation

Metric signals satisfy all three requirements simultaneously. Metrics support dimensions (allowing you to filter/split by server name, counter name, etc.), have near-real-time evaluation (typically 1-minute granularity), and natively support a stateful alert model that fires once on trigger and once on resolution - unlike log alerts, which can repeatedly fire.

Why the distractors are wrong:

• A (Log) and B (Log Saved Query): Log-based alerts have higher latency (minimum 5-minute query intervals), and by default are stateless, meaning they can generate repeated notifications rather than a single alert/resolve pair - failing two of the three requirements.
• D (Activity Log): Activity Log alerts track Azure control-plane events (e.g., resource creation/deletion), not performance counter data from servers - completely wrong signal type for this scenario.

Memory tip: Think "Metric = Minimal latency + Multidimensional + Momentary alerts (once on/once off)." Whenever an exam question stresses fast alerts, dimensions, and single fire/resolve notifications together, Metric signals are almost always the answer. Log Analytics can collect the performance counters, but once ingested, Azure Monitor converts them into metrics, making Metric alerts the optimal choice.

No community discussion yet for this question.