AZ-204 Implement Azure security Practice Question
Your company uses Microsoft Defender for Cloud. You need to receive alerts when a user modifies a Key Vault access policy. What should you configure?
⚠ Common exam trap
The trap here is that candidates may overcomplicate the solution by choosing logging or SIEM options, not realizing that Azure Activity Log alerts provide a simple, built-in mechanism for monitoring control-plane changes like access policy modifications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up an activity log alert on the Key Vault
Activity log alerts in Azure Monitor can be configured to trigger on specific administrative operations, such as 'Microsoft.KeyVault/vaults/accessPolicies/write'. This allows you to receive near real-time notifications when a Key Vault access policy is modified, directly addressing the requirement without additional services or complex setups.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an Azure Policy to audit access policy changes
Why it's wrong here
Creating an Azure Policy is designed for auditing resource configurations against defined standards and enforcing compliance across your Azure environment. While it can report on the compliance state of Key Vault access policies, it does not provide real-time, immediate alerts when a specific operational change, such as a modification to an access policy, occurs. Its primary function is to assess and maintain configuration compliance, not to trigger alerts based on activity log events.
- ✗
Configure Microsoft Sentinel to monitor Key Vault
Why it's wrong here
Configuring Microsoft Sentinel involves deploying a comprehensive Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. While Sentinel is capable of ingesting Key Vault logs and generating sophisticated alerts, it is an extensive and complex platform intended for large-scale threat detection and incident response across an entire enterprise. For the specific requirement of simply alerting on Key Vault access policy changes, utilizing Sentinel is disproportionately complex and resource-intensive compared to a native Azure alerting mechanism.
- ✗
Enable Key Vault logging and query logs
Why it's wrong here
Enabling Key Vault logging directs operational data, including access policy changes, to a Log Analytics workspace or storage account for retention. While these logs provide a detailed historical record of all Key Vault activities, querying them is a reactive process primarily used for post-incident analysis, auditing, or troubleshooting. This method does not provide immediate, proactive notifications when a specific event, like an access policy modification, occurs, thus failing to meet the requirement for a real-time alert.
- ✓
Set up an activity log alert on the Key Vault
Why this is correct
Setting up an activity log alert on the Key Vault is the most direct and efficient solution for real-time notification of control plane operations. Azure Activity Log alerts are specifically designed to trigger notifications or automated actions in response to events recorded in the Azure Activity Log, which captures management operations such as creating, updating, or deleting resources. By configuring an alert rule with specific criteria for Key Vault access policy write operations, immediate notifications can be delivered effectively.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.