Your Azure SQL Database contains sensitive financial data. You need to audit all data modifications (INSERT, UPDATE, DELETE) and store the audit logs in a central Azure Storage account for compliance. What should you configure?
Auditing captures data modifications and can be stored in storage.
Why this answer
Azure SQL Database's built-in auditing feature can be configured to capture all data modifications (INSERT, UPDATE, DELETE) and write audit logs directly to an Azure Storage account. This meets the compliance requirement for centralized, durable storage of audit records without additional services or complex pipelines.
Exam trap
The trap here is confusing security monitoring tools (Defender for SQL, Vulnerability Assessment) or performance diagnostics (query store) with the specific auditing feature required for capturing data modification logs for compliance.
How to eliminate wrong answers
Option B is wrong because diagnostic settings streaming query store data to an event hub captures performance and query metrics, not data modification audit logs; it is designed for real-time monitoring, not compliance auditing. Option C is wrong because Microsoft Defender for SQL provides security alerts and threat detection, not granular audit logs of INSERT/UPDATE/DELETE operations; its alerts are sent to security teams, not stored as a compliance audit trail. Option D is wrong because SQL Vulnerability Assessment scans for security misconfigurations and exports assessment results, not data modification audit logs; it is a security posture tool, not an auditing solution.