Exam AZ-500 topic 4 question 51 discussion

NO: VM1 is suppressed, examplae maintenance YES: Rule is OK NO: Tags not Administrative operations

I confirm this in a lab. The alerts ALWAYS are generated. In Monitor/Alerts/click in Total Alerts, you can see all alerts. In this view you can choose "edit column" and add "Suppression Status" column. Now you can see each alert with "None" or "Suppressed" status. In this questions, always ask about "an alert is triggered" and always it is. The action rule is defined for Suppression and with it, you won't get for example an email notification if you have configured an action group,. So answering the questions for me is Yes in all of them because an alert is always triggered.

NNY 1)The alert rule is scoped to RG1, and it triggers based on all administrative operations within RG1. VM1 is part of RG1, so if an administrative operation (such as starting VM1) occurs on VM1, the alert rule can be triggered. However, there is an action rule in place that applies suppression to VM1. Since the suppression is defined as "always" for VM1, any alert related to VM1 (including starting the VM) will not trigger the alert. Answer: No 2)The alert rule is scoped to RG1, and it triggers based on all administrative operations within RG1. VM2 is part of RG2, which is a different resource group, so any operations on VM2 (like starting it) would not trigger the alert rule, which is scoped to RG1. Answer: No 3)The alert rule is scoped to RG1 and triggers on all administrative operations within RG1. Adding a tag to RG1 is considered an administrative operation within the scope of RG1. As a result, the alert will be triggered when a tag is added to RG1, since this operation falls within the conditions specified in the alert rule. Answer: Yes

Yes, Yes, Yes - Tags are administrative actions. Suppressed alerts will still trigger, BUT the underlying action will not be done (that's the thing that is actually getting suppressed, not the alert itself)

NO - Suppression rule for VM1 in place (alert is still created but does not trigger an action) YES - Matches the alert definition, not suppressed YES - Matches the alert definition, not suppressed

got an alert notification for tag. Y Y Y for me

Tag operations are ABSOLUTELY an administrative category. 1. Create RG1 2. Add a tag to RG1 3. Go to the Activity Log of the RG1 and filter by "Event category=Administrative". (it can take 1-2 minutes for the record to appear). Stop affirming to stuff you know nothing about. "Category: Administrative: Contains the record of all create, update, delete, and action operations performed through Resource Manager." https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log-schema#categories

Discussion is really confusing, So I tested the scenario by myself. - Tag is definitely administrator action. - All alerts are triggered and I got notification e-mail. In the alerts at the bottom there is a info about Suppression status: None or Suppressed. I can see that for VM1 status is Suppressed and VM2 is NONE. So the answer: Y Y Y

Box 1: NO The scope for the action rule is set to VM1 and is set to suppress alerts indefinitely. Box 2: YES The scope for the action rule is not set to VM2. Box 3: NO Adding a tag is not an administrative operation. References: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-activity-log https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-action-rules

Explanation: Box1: Activity log - Azure activity logs provide insight into the operations that were performed on resources in your subscription. Activity logs were previously known as audit logs or operational logs, because they report control-plane events for your subscriptions. Activity logs help you determine the what, who, and when for write operations (that is, PUT, POST, or DELETE). Box 2: Logs - Log Integration collects Azure diagnostics from your Windows virtual machines, Azure activity logs, Azure Security Center alerts, and Azure resource provider logs. This integration provides a unified dashboard for all your assets, whether they're on-premises or in the cloud, so that you can aggregate, correlate, analyze, and alert for security events. Reference: https://docs.microsoft.com/en-us/azure/security/azure-log-audit

Box 1: NO The scope for the action rule is set to VM1 and is set to suppress alerts indefinitely. Box 2: YES The scope for the action rule is not set to VM2. Box 3: NO Adding a tag is not an administrative operation. References: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-activity-log https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-action-rules

Yes "Alert1" will trigger However, the action rule "ActionRule1" with suppression configured on VM1 will prevent any actions associated with the alert from being executed Yes when VM2 is started, the alert rule "Alert1" will be triggered, and the actions defined in "ActionGroup1" will be executed No Alert1" that is configured to trigger on all administrative operations within RG1 does not explicitly mention adding a tag as a condition.

so what is the right answer?!

NO YES YES

Alerts are still fired, they just won't trigger action groups when suppressed: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-processing-rules?tabs=portal

I side with khengoolman. NNY

Alert processing rules were previously known as 'action rules'