A security team needs platform logs and metrics from an Azure Key Vault to be searchable later in a Log Analytics workspace so they can investigate administrative changes and access trends. What should you configure on the Key Vault?

Azure Monitor private link scope

Private link scope helps secure ingestion and access paths, but it does not turn on collection of Key Vault logs and metrics by itself.

An activity log alert on the subscription only

Activity log alerts can notify on selected subscription events, but they do not send the Key Vault's resource logs and metrics into a workspace for querying.

A resource lock on the Key Vault

A lock protects the resource from deletion or modification, but it does not enable telemetry export or searchable monitoring data.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: A diagnostic setting that sends logs and metrics to the workspace — Diagnostic settings are the correct choice because they are designed to route resource logs and metrics from an Azure service into destinations such as Log Analytics, Event Hubs, or storage. In this case, the team wants searchable data in a workspace, which is exactly what a diagnostic setting provides. Once the data is there, analysts can use KQL to investigate key usage, administrative actions, and access trends. Why others are wrong: Azure Monitor private link scope secures monitoring traffic but does not itself collect logs. Activity log alerts are useful for subscription-level events, but they do not ingest the resource's logs and metrics into Log Analytics. A resource lock only restricts management actions and has nothing to do with telemetry collection.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.