CCSP Cloud Security Operations Practice Question
A security analyst is investigating a potential security incident in a Microsoft Azure environment. The analyst needs to review the history of role assignments and changes to Azure resources over the past 90 days. Which Azure service should the analyst use?
⚠ Common exam trap
Many exam-takers confuse Microsoft Entra ID Audit Logs with Azure Activity Log, as both are audit logs but cover different scopes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Activity Log
The Azure Activity Log is the correct service because it records subscription-level events, including role assignments and resource modifications, and retains them for 90 days. This directly matches the analyst's need to review the history of changes over that period. Other services either focus on different scopes (like Microsoft Entra ID) or require additional configuration for log retention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Monitor Logs
Why it's wrong here
Azure Monitor Logs is a platform for collecting and analyzing telemetry from various sources, including application and infrastructure logs. While it can ingest Activity Log data, it requires configuration and does not natively retain Activity Log events for 90 days without additional setup. It is not the primary service for reviewing role assignments and resource changes out of the box.
- ✗
Azure Security Center
Why it's wrong here
Azure Security Center (now Microsoft Defender for Cloud) provides security posture management and threat protection. It offers recommendations and alerts but does not store a detailed history of role assignments and resource changes. It is not designed for auditing historical changes, so it would not meet the analyst's need to review the past 90 days of activity.
- ✓
Azure Activity Log
Why this is correct
The Azure Activity Log provides a history of subscription-level events, including role assignments and resource changes. It retains data for 90 days by default, which aligns with the analyst's requirement. By reviewing the Activity Log, the analyst can see who made changes, what resources were affected, and when the changes occurred, which is essential for incident investigation.
- ✗
Microsoft Entra ID Audit Logs
Why it's wrong here
Microsoft Entra ID Audit Logs track activities related to Microsoft Entra ID, such as user sign-ins and directory changes. They do not cover role assignments and resource changes in Azure subscriptions, which are recorded in the Azure Activity Log. Therefore, Microsoft Entra ID Audit Logs would not provide the required information for investigating changes to Azure resources.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.