CCSP Cloud Security Operations Practice Question
A company is deploying a SIEM solution in Azure. Which THREE data sources should be ingested to provide comprehensive visibility into the cloud environment?
⚠ Common exam trap
Candidates often misinterpret the question as requiring network logs (VNet Flow Logs) for completeness, but the three core SIEM sources in Azure are Activity Logs, AD sign‑in logs, and Defender alerts. Flow Logs are valuable but not essential for a basic comprehensive SIEM deployment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Activity Logs
Azure Activity Logs provide a control-plane audit trail for all resource management operations, including create, update, and delete actions, which is essential for detecting unauthorized changes. Azure Active Directory sign-in logs offer identity-level visibility into authentication attempts, helping to identify brute-force or compromised accounts. Azure Defender for Cloud alerts aggregate security findings from various services, highlighting active threats and vulnerabilities. Azure VNet Flow Logs, while useful for network traffic analysis, are not among the three most critical for comprehensive SIEM visibility; they produce high volume and cost, and are often supplemented by other sources. Azure Monitor Metrics focus on performance data rather than security events, making them less relevant for SIEM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Activity Logs
Why this is correct
Azure Activity Logs are correct because they provide the control-plane audit trail for all Azure resource management operations, including create, update, and delete actions. This is essential for detecting unauthorized configuration changes and meeting compliance requirements in a SIEM.
- ✓
Azure Active Directory sign-in logs
Why this is correct
Azure Active Directory sign-in logs are correct because they provide identity-level tracking of authentication attempts, which is crucial for detecting brute-force attacks, compromised credentials, and unusual sign-in patterns.
- ✗
Azure VNet Flow Logs
Why it's wrong here
Azure VNet Flow Logs are incorrect for this selection because, although they provide network traffic metadata, they are not among the three most critical sources for overall SIEM visibility. The core three are Activity Logs, AD sign-in logs, and Defender alerts; VNet Flow Logs are valuable but secondary, often used for specific network investigations.
- ✗
Azure Monitor Metrics
Why it's wrong here
Azure Monitor Metrics are incorrect because they focus on performance and operational data (e.g., CPU, memory) rather than security-relevant audit events. They are not a primary data source for SIEM systems, which require logs and alerts.
- ✓
Azure Defender for Cloud alerts
Why this is correct
Azure Defender for Cloud alerts are correct because they aggregate security findings from across Azure services, including vulnerability assessments, threat detections, and policy violations, providing a centralized view of active threats.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.