AZ-500 Secure compute, storage, and databases Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable SQL Auditing and set the destination to a Log Analytics workspace in a different region.

  Why it's wrong here

  While Azure SQL Auditing does support Log Analytics as a destination, a Log Analytics workspace is a regional resource and does not provide automatic geo-replication of audit data. If the workspace's region experiences an outage, audit records for failed logins become unavailable for forensic or compliance purposes. An Azure Storage account in a separate region is the better choice because it can be configured with GRS/GZRS, providing paired-region durability that Log Analytics lacks by default.

• ✗

  Enable SQL Auditing and set the destination to an Event Hub namespace in the same region.

  Why it's wrong here

  Event Hubs is primarily a real-time streaming ingestion service rather than a durable archive. With a destination in the same region, there is no cross-region redundancy, and Event Hubs has a limited retention window (for example, 7 days in the Standard tier) unless you explicitly configure Capture to deliver events to storage. Streaming audit records to Event Hubs is useful for live SIEM integration, but it does not meet long-term, geo-redundant retention requirements for login auditing.

• ✓

  Enable SQL Auditing and set the destination to an Azure Storage account in a different region.

  Why this is correct

  Azure SQL Auditing can write audit logs directly to an Azure Storage account, and placing that account in a different region provides geographic separation for disaster recovery. You can select a storage account configured with geo-redundant storage (GRS) or geo-zone-redundant storage (GZRS), so audit .xel files are replicated to a paired region and remain accessible even if the primary SQL database region fails. This durable, long-term storage model satisfies compliance requirements for failed-login auditing and supports immutable retention policies to prevent tampering.

• ✗

  Enable Advanced Threat Protection for Azure SQL Database and configure email notifications.

  Why it's wrong here

  Advanced Threat Protection for Azure SQL Database (part of Microsoft Defender for SQL) is a detection-oriented service that identifies anomalies like SQL injection, brute-force attempts, and unusual access patterns, then sends alerts via email or Defender for Cloud. It does not produce a complete, customizable audit trail of every failed login attempt, nor does it provide a geo-redundant storage destination for audit records. Email notifications only inform you of suspected threats, so they cannot substitute for a proper auditing configuration.