An organization must retain Azure Key Vault audit data for 18 months, search the data in Log Analytics, and keep a second copy if the workspace retention policy is later shortened. The operations team already has an action group for notifications. What should be configured on the Key Vault?

Create an activity log alert and point it at the existing action group.

Activity log alerts detect subscription events, but they do not store resource-level audit data for long-term searching.

Create a metric alert on the Key Vault and archive the alert history.

Metric alerts are useful for threshold-based monitoring, but they do not capture detailed audit events or provide retained raw log copies.

Enable only resource metrics and rely on workspace retention for compliance.

Metrics do not contain the audit details required for key vault investigations, and workspace retention alone provides no second copy.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Create a diagnostic setting that streams AuditEvent logs to Log Analytics and a storage account. — Diagnostic settings are the Azure Monitor feature that exports a resource's logs and supported metrics. In this scenario, the organization needs both searchable audit data in Log Analytics and a separate retained copy that survives workspace retention changes. Streaming the Key Vault AuditEvent category to Log Analytics and storage satisfies both needs. The action group is useful for notifications, but it does not collect or retain the telemetry itself. Why others are wrong: An activity log alert only watches subscription-level events and does not preserve the Key Vault's audit stream. Metric alerts can detect thresholds, but they do not contain the raw operations needed for forensic review. Enabling metrics alone is insufficient because metrics are aggregated signals, not detailed audit records, and they do not provide a second durable copy.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.