From Azure Security Center, you create a custom alert rule. You need to configure which users will receive an email message when the alert is triggered. What should you do?

Question

Options

• AFrom Azure Monitor, create an action group.
• BFrom Security Center, modify the Security policy settings of the Azure subscription.
• CFrom Azure Active Directory (Azure AD), modify the members of the Security Reader role group.
• DFrom Security Center, modify the alert rule.

• A
  79% (31)
• B
  13% (5)
• C
  3% (1)
• D
  5% (2)

Explanation

Explanation

When a custom alert rule is triggered in Azure Security Center, the notification and response actions are handled through Azure Monitor Action Groups, which allow you to define who gets notified (via email, SMS, webhook, etc.) and what automated actions to take - making Option A the correct choice. Option B is incorrect because Security Policy settings govern security recommendations and data collection configurations, not alert notification recipients. Option C is incorrect because the Security Reader role grants read-only access to Security Center data but does not control who receives alert email notifications. Option D is incorrect because the custom alert rule itself defines the conditions that trigger the alert, not the notification targets - you cannot configure email recipients directly within the alert rule in Security Center.

Memory Tip

Think of it this way: Security Center detects, Azure Monitor acts. Security Center is responsible for finding threats, but Azure Monitor's Action Groups are the "phone book" that determines who gets called when something goes wrong. Whenever you see a question about configuring notifications or responses to alerts, think Action Groups in Azure Monitor.

No community discussion yet for this question.