AZ-305 Practice Question: Design identity, governance, and monitoring solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Monitor Metrics

  Why it's wrong here

  Azure Monitor Metrics stores numeric performance counters and time-series data (such as CPU usage, memory consumption, and disk I/O) emitted by Azure resources. It contains no information about the identity of a user, the specific administrative action performed, or the timestamp of management-plane operations like creating or deleting a resource. Therefore, it cannot be used to audit administrative actions, even though it may be valuable for detecting performance anomalies.

• ✗

  Azure Resource Health

  Why it's wrong here

  Azure Resource Health continuously assesses whether an Azure resource is currently available and provides a status of either 'Available,' 'Unavailable,' or 'Unknown,' along with a history of platform and non-platform events that affected availability. It reports on service health and outages, not on who executed a management operation such as stopping a virtual machine or updating a firewall rule. Therefore, it cannot provide an audit trail of administrative actions, as it is designed for monitoring live health rather than recording operation logs.

• ✓

  Azure Activity Log

  Why this is correct

  The Azure Activity Log is a subscription-level audit log that records every control-plane operation (create, update, delete, and write) on Azure resources, including the actor (who initiated the action), the timestamp, the operation name, and the status. It captures administrative actions such as starting or stopping a virtual machine, modifying a network security group, or assigning a policy, and can be retained for up to 7 years when exported to a storage account or Log Analytics workspace. This makes it the correct source for answering who did what, when, and where in your Azure environment.

• ✗

  Microsoft Entra ID audit logs

  Why it's wrong here

  Microsoft Entra ID audit logs record identity-related activities in the directory, such as user sign-ins, password resets, group membership changes, and application registrations. They do not capture Azure resource control-plane operations, like creating a virtual network or restarting a database server, because those are management operations on Azure resources, not on directory objects. Thus, while Entra ID audit logs are essential for identity governance and security investigations, they are not a substitute for the Azure Activity Log when auditing administrative actions on resources.

Go deeper

Related to this question