Exam AZ-104 topic 6 question 36 discussion

Tested in a lab. User 1 - Alert 1 and Alert 2 fired Alert 1 operations: Microsoft.Compute/virtualMachines/write Microsoft.Compute/disks/write Alert 2 operations: Microsoft.Compute/virtualMachines/write User 2 - Alert 1 fired Alert 1 operations: Microsoft.Resources/tags/write

nobody's got a clue Mlantonis where are you!!!

User 1 - Alert 1 & Alert 2 User 2 - Alert 1 & Alert 2

User1: Both alerts User2: Both alerts are triggered --> any operation that changes the metadata or configuration of VM1, including adding or modifying tags, falls under administrative operations and will be captured by the rule.

WRONG User1: Alert1 and Alert2 are triggered User2: Alert1 and Alert2 are triggered

Answer is correct. Alert 1 is scoped to the Resource Group (RG1). This means it will only trigger when there are administrative operations performed on the resource group itself or on resources directly within the resource group. While VM1 is likely part of RG1, the act of attaching a disk to VM1 is considered an operation on the VM, not on the resource group. Alert 2 is scoped to the Virtual Machine (VM1). This means it will trigger when there are administrative operations performed directly on VM1. Creating a new virtual disk and attaching it to VM1 is considered an administrative operation on the VM, so it triggers Alert 2.

User1: Alert1 and Alert2 are triggered. User2 : Alert1 and Alert2 are triggered.

This question was in exam 01/03/2024

I tested this in my lab. User1: Alert1 and Alert2 are triggered. User2 : Alert1 and Alert2 are triggered. User1 operations: - Microsoft.Compute/virtualMachines/write (on the VM itself, triggering Alert2) - Microsoft.Compute/disks/write (on the RG, triggering Alert1) User2 Operations: Microsoft.Resources/tags/write (on the RG, triggering Alert1) Microsoft.Resources/tags/write (on the VM, triggering Alert2)

I have tested in the lab! User 1 - Alert 1 and Alert 2 fired (tested with creating new data disk in same RG1 and in different RG and in both scenario the alerts fired for both VM&RG1) User 2 - Alert 1 and Alert 2 fired (this is very clear as you creating a tag and assign for both VM and RG!

User1 triggers: Alert2 (due to the disk operation on VM1). User2 triggers: Alert1 (due to tagging RG1) and Alert2 (due to tagging VM1).

User1 triggers alert2. User2 triggers both alert1 and alert2.

It should be "Alert1 and Alert2 are triggered" for both User 1 and User 2. Now lets analyze: User 1 operations: User 1 not only just attaches the disk to VM1 but rather creates a new disk. If you go on portal and goto Disks and select a VM and then create a new disk, it will ask you to select an existing resource group or create a new rg (usually we create the disk in the same rg as of vm which is RG1 here). This means that after creating the disk, the resource group will be updated, and it will have an operation occur on it. Once created, we then attach the new disk to VM1, which means VM1 is also affected now by the disk attach operation. So for User 1, Alert 1 and Alert2 both will be triggered because Alert1 has scope of RG1 and Alert 2 has scope of VM1. User 2 operations: This one is straightforward. User 2 assigns new tags to both RG1 and VM1. Thus write operations will be logged for both VM1 and RG1. Therefore, Alert1 and Alert2 both will be triggered.

User1: Alert1 and Alert2 are triggered User2: Alert1 and Alert2 are triggered Explanation: Each alert rule has a scope. A scope is a list of one or more specific Azure resources, a specific resource group, or an entire subscription. The alert rule fires on resources within that scope. Since VM1 is contained in RG1, User1's action falls within the scope of both Alert1 and Alert2. User1 triggers both alerts. User2 triggers Alert1 by creating the tag for RG1. User2 triggers both Alert1 and Alert2 by creating the tag for VM1.

User1 I'd say alert1, 2 Create disk needs to assign to RG as per below. https://learn.microsoft.com/en-us/cli/azure/disk?view=azure-cli-latest And assign to VM will trigger alert as per admin op User2, Not 100% but I'm tempted to say alert 1,2 because assign tag to both would be an action. see; https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-types#log-alerts & https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log-schema

Does deploying a new virtual disk not require deploying it to resource group? And if we're deploying it to RG1 is that not an administrative operation for RG1?

creating a disk and adding it to the VM is a provision task not an administrative task