CCSP Cloud Security Operations Practice Question
A financial services company uses Azure and must ensure that all administrative actions in their Azure subscription are logged and that logs are stored in an immutable storage account for 7 years. They also need to be able to alert on specific critical operations, such as deletion of a resource group. Which combination of Azure services should they implement?
⚠ Common exam trap
The trap here is assuming that Log Analytics or Event Hubs provide immutable long-term storage, when they are designed for analysis and transient processing, not compliance-grade retention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Monitor activity log, Azure Storage with immutable blob storage, and Azure Monitor alerts.
The Azure Monitor activity log is the source for subscription-level administrative events. To achieve immutability, logs must be exported to a storage account configured with immutable blob storage policies. Azure Monitor alerts can be set up to trigger on specific operations like resource group deletion. This trio meets logging, retention, and alerting requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Monitor activity log, Azure Event Hubs, and Azure Stream Analytics.
Why it's wrong here
While the activity log can be streamed to Event Hubs for processing, Event Hubs is a transient data ingestion service, not a long-term immutable store. Stream Analytics can analyze data in motion but does not provide storage. This setup lacks the immutable storage account for 7-year retention, violating the compliance requirement. It also does not provide native alerting on specific operations without additional configuration.
- ✗
Azure Security Center (now Microsoft Defender for Cloud), Azure SQL Database auditing, and Azure Logic Apps.
Why it's wrong here
Microsoft Defender for Cloud provides security posture and threat protection but does not log all administrative actions. Azure SQL Database auditing is limited to database-level events. Logic Apps can automate workflows but do not inherently capture or store activity logs immutably. This combination fails to provide comprehensive administrative logging and immutable retention as required.
- ✓
Azure Monitor activity log, Azure Storage with immutable blob storage, and Azure Monitor alerts.
Why this is correct
The Azure Monitor activity log captures subscription-level control plane operations, including resource group deletions. Exporting to a storage account with immutable blob storage (using time-based retention policies) ensures logs cannot be altered or deleted for the specified period. Azure Monitor alerts can trigger on specific events from the activity log, such as Delete Resource Group, providing real-time notification.
- ✗
Azure Log Analytics workspace, Azure Monitor alerts, and Azure Automation runbooks.
Why it's wrong here
Log Analytics can collect activity logs and support alerting, but it does not provide immutable storage. Data in Log Analytics can be modified or deleted based on retention settings, and administrators can purge data. Automation runbooks can remediate but not store logs immutably. This option fails the requirement for immutable storage of logs for 7 years.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.