Exam AZ-500 All QuestionsBrowse all questions from this exam
Go to Exam
Question 277

HOTSPOT -

You have an Azure subscription that contains the resources shown in the following table.

VM1 and VM2 are stopped.

You create an alert rule that has the following settings:

✑ Resource: RG1

✑ Condition: All Administrative operations

✑ Actions: Action groups configured for this alert rule: ActionGroup1

✑ Alert rule name: Alert1

You create an action rule that has the following settings:

✑ Scope: VM1

✑ Filter criteria: Resource Type = "Virtual Machines"

✑ Define on this scope: Suppression

✑ Suppression config: From now (always)

✑ Name: ActionRule1

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Note: Each correct selection is worth one point.

Hot Area:

    Correct Answer:

    Box 1:

    The scope for the action rule is set to VM1 and is set to suppress alerts indefinitely.

    Box 2:

    The scope for the action rule is not set to VM2.

    Box 3:

    Adding a tag is not an administrative operation.

    References:

    https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-activity-log https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-action-rules

Discussion
JAGUDERO

NO: VM1 is suppressed, examplae maintenance YES: Rule is OK NO: Tags not Administrative operations

Lobo

NYY, Tags are administrative actions...

wannabepro789

Can confirm - tested in lab Adding a tag adds a 'Write Tags' operation event under RG1 activity log. Also, for completeness, obviously gets written to the subscription Activity logs as well.

khengoolman

The correct answer is N N N NO: Scope of alert is RG1, not VM, start action on the VM does NOT trigger the RG admin action alert. NO: See above. YES: Tagging is absolutely an administrative operation. I have tested this by creating resources, tagging, turning on off and setting alert rules for both VM and RG, when the alert rule is set to VM scope, turning the resource ON/OFF DOES trigger the alert.

khengoolman

N N Y sorry, wish you could edit...

achechen

confirmed in a lab

madhatter

Anyone confused about the second option being YES. The Action (suppress) Scope is only set to VM1. So the suppression action does not apply to VM2.

epomatti

WRONG! Tags are administrative operations.

Karls

I confirm this in a lab. The alerts ALWAYS are generated. In Monitor/Alerts/click in Total Alerts, you can see all alerts. In this view you can choose "edit column" and add "Suppression Status" column. Now you can see each alert with "None" or "Suppressed" status. In this questions, always ask about "an alert is triggered" and always it is. The action rule is defined for Suppression and with it, you won't get for example an email notification if you have configured an action group,. So answering the questions for me is Yes in all of them because an alert is always triggered.

ARDNK

[adding a tag is not an administrative operation]. how come Alert will be triggered? please explain

AzureJobsTillRetire

It is true that alters are already "fired", but it is not true that action groups are always "triggered". The question asks if the alters are triggered, and we should better interpret the question as if it asks if action groups are triggered. It is unlikely that Microsoft test us on the knowledge of alert firing in all variants of those questions. https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-processing-rules?tabs=portal

majstor86

NO YES YES

liorh

so what is the right answer?!

JakeCallham

I guess this is one of those question where nobody really know what the exact answer is. Even to those who tested in a lab come with different answers.

LouieBinondo

Absolutely :)

koreshio

yup, just like Microsoft does it with its products, they just deploy, let questions be raised and then refine or remove. newer versions of the exam should see less of such qs.

epomatti

Tag operations are ABSOLUTELY an administrative category. 1. Create RG1 2. Add a tag to RG1 3. Go to the Activity Log of the RG1 and filter by "Event category=Administrative". (it can take 1-2 minutes for the record to appear). Stop affirming to stuff you know nothing about. "Category: Administrative: Contains the record of all create, update, delete, and action operations performed through Resource Manager." https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log-schema#categories

rosef

Discussion is really confusing, So I tested the scenario by myself. - Tag is definitely administrator action. - All alerts are triggered and I got notification e-mail. In the alerts at the bottom there is a info about Suppression status: None or Suppressed. I can see that for VM1 status is Suppressed and VM2 is NONE. So the answer: Y Y Y

kabooze

Alerts are still fired, they just won't trigger action groups when suppressed: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-processing-rules?tabs=portal

Alx3619

In Topic 3 question 26, adding a tag is considered an administrative operation but in Topic 3 question 57 it is not. Can someone explain the difference?

AzureJobsTillRetire

Topic 3 question 26 is a simulation. Has the question moved? I cannot find anywhere else that says adding a tag is considered an administrative operation. Has anyone else noticed?

Shyammmcfy

got an alert notification for tag. Y Y Y for me

hfk2020

The scope of the alert is RG it should have been RG->All Virtual machines then the alert would trigger so for both VMs the alert will not trigger So No No and Yes for the tags

wardy1983

Box 1: NO The scope for the action rule is set to VM1 and is set to suppress alerts indefinitely. Box 2: YES The scope for the action rule is not set to VM2. Box 3: NO Adding a tag is not an administrative operation. References: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-activity-log https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-action-rules

wardy1983

Explanation: Box1: Activity log - Azure activity logs provide insight into the operations that were performed on resources in your subscription. Activity logs were previously known as audit logs or operational logs, because they report control-plane events for your subscriptions. Activity logs help you determine the what, who, and when for write operations (that is, PUT, POST, or DELETE). Box 2: Logs - Log Integration collects Azure diagnostics from your Windows virtual machines, Azure activity logs, Azure Security Center alerts, and Azure resource provider logs. This integration provides a unified dashboard for all your assets, whether they're on-premises or in the cloud, so that you can aggregate, correlate, analyze, and alert for security events. Reference: https://docs.microsoft.com/en-us/azure/security/azure-log-audit

alisyed

you are answering the wrong question here

wardy1983

Box 1: NO The scope for the action rule is set to VM1 and is set to suppress alerts indefinitely. Box 2: YES The scope for the action rule is not set to VM2. Box 3: NO Adding a tag is not an administrative operation. References: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-activity-log https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-action-rules

Ario

Yes "Alert1" will trigger However, the action rule "ActionRule1" with suppression configured on VM1 will prevent any actions associated with the alert from being executed Yes when VM2 is started, the alert rule "Alert1" will be triggered, and the actions defined in "ActionGroup1" will be executed No Alert1" that is configured to trigger on all administrative operations within RG1 does not explicitly mention adding a tag as a condition.

Fal991l

I side with khengoolman. NNY

somenick

Alert processing rules were previously known as 'action rules'