DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing
Your Azure Data Lake Storage Gen2 account stores sensitive data. You need to audit who accesses the data and when, and you want to send the audit logs to a Log Analytics workspace for analysis. What should you configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Diagnostic settings on the storage account
Diagnostic settings on the storage account can stream audit logs (like read, write, delete) to Log Analytics for analysis. Option A is incorrect because Azure Activity Logs capture control plane operations, not data plane access. Option B is incorrect because Microsoft Sentinel is a SIEM that would consume logs from diagnostic settings, not a direct configuration for log collection. Option C is incorrect because Azure Monitor alerts are for notifications based on metrics or logs, not for collecting logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Activity Logs
Why it's wrong here
Activity Logs record control-plane operations on the subscription, such as role assignments and resource changes, not per-object data reads or writes. Diagnostic settings on the storage account capture data-plane access and can route those records to a Log Analytics workspace.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a SIEM that ingests logs to detect and investigate threats; it does not itself generate the data-plane audit records. The stem asks for the source of access auditing, which diagnostic settings on the storage account provide before any SIEM consumes them.
- ✗
Azure Monitor alerts
Why it's wrong here
Azure Monitor alerts evaluate metric or log conditions and notify, but they neither capture data-plane access events nor forward them to a workspace. Diagnostic settings on the storage account are the mechanism that emits per-operation audit records to Log Analytics.
- ✓
Diagnostic settings on the storage account
Why this is correct
Diagnostic settings on the storage account route read, write and delete access logs to a Log Analytics workspace, capturing who accessed the data and when. This satisfies both the auditing and log-destination requirements stated in the stem.
Go deeper
Related to this question
About these practice questions
One of 509 original DP-203 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.