VM1 is an Azure virtual machine that sends event logs to Azure. You are creating an Azure Monitor alert to notify an administrator when an error appears in VM1's System event log. Which target resource should the alert monitor?

The correct target resource is an Azure Log Analytics workspace because it's where VM1's event logs are stored and analyzed. Azure Monitor alerts for log-based conditions, like specific event log entries, query the data within a Log Analytics workspace. A virtual machine extension is a small application that automates post-deployment configuration and isn't a target for log alerts. A virtual machine itself is the source of the logs, but the alert monitors the stored logs, not the VM directly for this type of condition. A metric alert is used for numerical data points (e.g., CPU usage), not for querying text-based log entries.