Examkin

Question

Difficulty: MediumAzure Monitor Alerts and Action Groups

An administrator configures an Azure Monitor activity log alert to trigger whenever a resource is deleted within a production resource group. The alert uses an action group that contains two actions: an email notification to the operations team and an SMS notification to the operations manager's mobile phone (+44 country code). During a testing window, an automated script deletes 10 temporary resources in the resource group within a two-minute period. The operations team receives 10 emails, but the operations manager only receives the first SMS notification. Which of the following is the most likely reason for this behavior?

  1. SMS actions in Azure Monitor action groups are rate-limited to a maximum of one message every 5 minutes.Answer
  2. B
    SMS actions in Azure Monitor action groups are rate-limited to a maximum of 10 messages per hour.
  3. C
    The operations manager's mobile phone country code is not supported for SMS notifications by Azure Monitor.
  4. D
    An alert processing rule is active that suppresses notifications for identical alerts within a 5-minute window.

Answer

SMS actions in Azure Monitor action groups are rate-limited to a maximum of one message every 5 minutes.
The correct answer is that SMS actions in Azure Monitor action groups are rate-limited to a maximum of one message every 5 minutes. Because the deletions occurred within a two-minute window, only the first event succeeded in sending an SMS, while the subsequent SMS notifications were suppressed by the rate-limiting mechanism. Emails were unaffected because their rate limit is much higher (100 emails per hour).

Step-by-Step Solution

1
Analyze the observed behavior of the notifications.
The email notification succeeded 10 times, but the SMS notification was delivered only once for the first event.
This indicates that the alert rule itself triggered 10 times and the action group was invoked 10 times, but one specific notification type (SMS) was restricted while the other (email) was not.
2
Evaluate the country code support.
Since the first SMS was successfully received by the manager (+44), the country code is supported by Azure Monitor action groups.
This rules out any static misconfiguration or lack of geographic support for the destination phone number.
3
Apply Azure Monitor action group rate limit rules to the timeline.
SMS notifications are limited to 1 message every 5 minutes, whereas email notifications are limited to 100 emails every hour.
The 10 deletions occurred within 2 minutes. The first deletion triggered the first SMS and email. The remaining 9 deletions occurred within the 5-minute SMS rate-limiting window, so the SMS actions were dropped, while the emails were delivered because 10 emails is well below the hourly limit of 100.

Key Concept

Azure Monitor Action Group Rate Limits
Rate this question

Topics

Azure Monitor Alerts and Action Groups

More questions from this topic