Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Retaining RBAC Audit Logs with Azure Monitor
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise security administrator needs to monitor and audit identity governance and role assignments across cloud resources. The organization requires a solution that can collect and retain audit logs showing which users were assigned access permissions, identify the administrators who performed the assignments, and provide interactive workbooks for historical analysis.
Which service should the administrator configure to retain and analyze these audit log events?
Explanations
Azure Monitor
Azure Monitor
What Azure Monitor Is
Azure Monitor is a comprehensive cloud monitoring and observability service in Microsoft Azure that collects, analyzes, and responds to telemetry from cloud and on-premises environments. It provides deep visibility into the performance, health, and security governance of systems and applications.
How It Meets the Auditing Requirements
- Audit Log Ingestion: Azure Monitor can ingest audit log events from identity governance and access management systems, capturing detailed activity such as role assignments and package fulfillment.
- Tracking Actor and Target: It retains logs detailing the specific administrator (
ActorUserPrincipalName) who granted or revoked permissions, along with the affected user and resource scope. - Interactive Visualization: Administrators can leverage built-in and custom Azure Monitor Workbooks to create interactive reports and perform historical trend analysis on access assignments over extended retention periods.
Key Advantages and Capabilities
- Centralized Telemetry: Aggregates log data across subscriptions, resource groups, and tenant-level identity logs into Log Analytics workspaces.
- KQL Query Support: Enables rich querying using Kusto Query Language (KQL) to detect unauthorized privilege elevation or anomalies.
- Custom Alerting: Integrates with action groups to generate real-time alerts when sensitive role assignments take place.
- Compliance Retention: Allows organizations to store audit trails beyond default operational windows to satisfy industry regulations.
Why This Is Optimal
Azure Monitor is the optimal choice because it natively centralizes and retains security and governance audit logs while offering built-in workbooks for visualization and alerting capabilities for proactive access auditing.
Azure Storage Shared Key Authorization
Azure Storage Shared Key Authorization
What Shared Key Authorization Is
Shared Key Authorization is an authentication mechanism for Azure Storage that uses account access keys to sign and authorize management and data plane REST requests against blob, table, queue, or file services.
Why It Doesn't Meet the Requirement
Shared Key authorization is an access mechanism that grants root-like permissions over storage account data. It is not an auditing, monitoring, or logging tool. Furthermore, relying on shared keys bypasses granular Azure role-based access control (RBAC) and obscures user identity attribution, making detailed audit tracking impossible.
Key Characteristics and Limitations
- Full Account Access: Account keys grant complete administrative and data access to all services in the storage account.
- Lack of User Attribution: Shared Key authentication does not record individual user identities when performing data operations.
- Security Risk: Poses significant security risk if keys are leaked, requiring key regeneration rather than fine-grained role auditing.
This Answer Would Be Correct If
The scenario required granting an application full access to an Azure Storage account via shared symmetric master keys rather than individual Entra ID identities.
Azure Resource Graph
Azure Resource Graph
What Azure Resource Graph Is
Azure Resource Graph is an Azure service designed to extend Azure Resource Management by providing efficient, performant, and scalable resource querying and exploration across multiple subscriptions and management groups.
Why It Doesn't Meet the Requirement
While Azure Resource Graph is powerful for querying the current state, properties, and configurations of Azure resources at scale, it is not an audit log aggregation or long-term event retention platform. It cannot capture the sequence of identity lifecycle events, such as which administrator approved or executed an access request, nor does it maintain interactive audit workbooks for historical event analysis.
Key Characteristics and Limitations
- Current State Focus: Queries resource metadata and current inventory rather than capturing chronological audit log streams.
- Governance Extension: Enables exploratory queries across resource properties and planned maintenance notifications.
- No Native Event Ingestion: Does not act as a centralized log analytics repository for identity and role assignment audit trails.
This Answer Would Be Correct If
The organization needed to quickly run high-performance queries across thousands of subscriptions to discover which virtual machines or storage accounts currently exist and check their configuration properties.
Azure Automation State Configuration
Azure Automation State Configuration
What Azure Automation State Configuration Is
Azure Automation State Configuration is a cloud-based configuration management service built on PowerShell Desired State Configuration (DSC) that allows administrators to define, deploy, and enforce consistent configuration settings on virtual and physical machines.
Why It Doesn't Meet the Requirement
Azure Automation State Configuration focuses on preventing configuration drift on operating systems and managing node software states. It does not monitor identity governance, collect role assignment audit records, or provide interactive analytical workbooks for reviewing access modifications.
Key Characteristics and Limitations
- DSC Pull Server: Acts as a central pull server to distribute DSC configurations to virtual machines in Azure or on-premises.
- Node Drift Monitoring: Continuously tracks whether target servers remain in their desired configuration state.
- Workload Focused: Operates at the virtual machine operating system layer rather than the identity and access management control plane.
This Answer Would Be Correct If
The scenario required enforcing specific operating system baseline configurations, registry keys, or software packages across a fleet of Windows and Linux servers.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Custom Roles
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Scope Inheritance
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Scope and Role Assignment
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC Scope
Describe Azure role-based access control (RBAC)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Blob Storage
Describe Azure resources and resource groups
ExpertAZ-500 Microsoft Azure Security Technologies Exam
Application Permissions vs Delegated Permissions
Configure app registration permission scopes
Last updated Validated