AZ-900 Describe Azure management and governance Practice Question
Which Azure feature provides audit logs that record every action taken on secrets in Azure Key Vault?
⚠ Common exam trap
It's easy for candidates to confuse Azure Monitor Metrics (which shows performance counters) with diagnostic logs (which show detailed audit trails), or they assume Azure Policy or RBAC logs inherently record all secret actions, when in fact only diagnostic logging captures the granular operation-level audit data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault diagnostic logging
Azure Key Vault diagnostic logging captures detailed audit logs for every operation performed on secrets, keys, and certificates, including read, write, delete, and backup actions. These logs are sent to Azure Monitor Logs, Storage Accounts, or Event Hubs, enabling security auditing and compliance monitoring. This is the correct feature because it directly records all actions on secrets at the vault level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is an Azure service that enforces organizational standards and compliance by evaluating resource configurations against defined rules, such as requiring TLS on storage accounts or restricting resource locations. It works by either denying non-compliant resource creation or applying the appropriate configuration, but it does not capture, record, or expose operational audit logs of Key Vault access. Policy events may appear in the activity log, but these are policy evaluation/effect actions, not detailed records of who read a particular secret or key, which is why it cannot serve as the source for auditing vault operations.
- ✓
Azure Key Vault diagnostic logging
Why this is correct
Azure Key Vault diagnostic logging is the feature that enables exporting the built-in audit event logs generated for every Key Vault operation, including attempts to access, create, update, delete, or list keys, secrets, and certificates. These logs capture the user or application principal, the timestamp, the source IP address, and the exact operation performed, and can be streamed to a Log Analytics workspace, Storage account, or Event Hub for centralized monitoring and compliance reporting. Enabling diagnostic settings on the vault is the correct and primary method to retain and query full audit trails of who accessed what within a specific Key Vault.
- ✗
Azure Monitor Metrics
Why it's wrong here
Azure Monitor Metrics collects numeric time-series data such as the overall count of Key Vault API calls, the average latency, or throttling events, which are useful for detecting performance anomalies or capacity issues. While some metrics like 'Service Api Hit' and 'Service Api Latency' give aggregate indicators of activity, they do not contain per-request identity details, the specific secret or key name, or the result of the operation (success/failure/denied). Therefore, metrics cannot be used to answer audit questions about which user or application retrieved a specific secret at a given time.
- ✗
Azure RBAC access logs
Why it's wrong here
Azure RBAC access logs as a term is misleading because RBAC itself is an authorization system, not a logging mechanism. The Azure Activity Log records administrative and permission-related changes, such as role assignments modifying who has access to a Key Vault, but it does not log the actual data-plane operations like reading a secret or using a key. To audit the operational use of the vault's objects, you need Key Vault's own diagnostic logs, which capture each request against the vault data plane, independent of how permissions were granted or changed.
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.