The correct options are Log alerts execute the configured query on a repeating schedule and fire when results satisfy the rule and Action groups specify the set of notification channels and recipients.

Log alerts execute the configured query on a repeating schedule and fire when results satisfy the rule run queries against a Log Analytics workspace on the cadence you set and then evaluate the query results to determine whether the alert condition is met. This makes them suitable for complex or content based detection where a query result or count is used to trigger an alert.

Action groups specify the set of notification channels and recipients are reusable collections of notification and action settings that Azure Monitor invokes when an alert fires. You include channels such as email and SMS and webhooks and automation runbooks and you can attach the same action group to multiple alerts.

Metric alerts cannot be created from log queries is incorrect because metric alerts are intended for numeric metric series while you can also create metrics that originate from logs and then alert on those metrics. The distinction is that metric alerts evaluate time series metrics and log alerts evaluate query results.

Log alerts only operate for virtual machines is incorrect because log alerts apply to any resource that sends logs to a Log Analytics workspace. They are not limited to virtual machines and can monitor applications and platform services when their telemetry is collected.

Full AWS Practitioner Certification Question