The key requirement is to detect when the daily average of percent_null is greater than 5% for three consecutive days .

Option A only checks the last 24 hours , not consecutive days . It would trigger too frequently and cause spam.

Option C calculates an average across all records in the last 3 days , but this could be skewed by one high or low day — it does not ensure consecutive daily violations .

Option D simply counts days where the threshold was exceeded, but it does not guarantee that those days were consecutive . This could incorrectly trigger on non-adjacent violations.

Option B is correct:

It aggregates hourly values into daily averages .

It checks that the last 3 consecutive days all had averages above 5%.

It avoids redundant alerts by using Notification Frequency: Just once.

This matches Databricks Lakehouse Monitoring best practices , where SQL alerts should be designed to aggregate metrics to the correct granularity (daily here) and ensure consecutive threshold violations before triggering.

Reference (Databricks Lakehouse Monitoring, SQL Alerts Best Practices):

Use DATE_TRUNC to compute metrics at the correct time granularity.

To detect consecutive-day issues, filter the last N daily aggregates and check conditions across all rows.

Always configure alerts with controlled notification frequency to prevent alert fatigue.