An operations team needs Windows event logs from Azure VMs and audit records from Key Vault. Which collection combination should it recommend?

Choose the single best answer.

A.AMA on every VM, with no Key Vault diagnostic settings.
B.AMA with associated DCRs for VM events, and Key Vault diagnostic settings for audit logs.
C.Key Vault diagnostic settings for both VM guest events and vault audit logs.
D.A Log Analytics workspace with no additional collection configuration.

Show the answer and explanation

✓ Correct answer

AMA with associated DCRs for VM events, and Key Vault diagnostic settings for audit logs.

AMA and DCR associations collect supported guest events, while resource diagnostic settings collect Key Vault audits. An agent does not configure a vault's diagnostic logs; a vault setting does not collect guest events. Creating the destination alone does not initiate either collection path. Source: AZ-305 Study Guide.pdf, PDF page(s) 8.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.