Design solutions that align with security best practices and priorities →easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
You are designing a security solution for Azure resources. You need to ensure that any changes to network security groups (NSGs) are automatically logged and sent to a central Log Analytics workspace. Which Azure feature should you use?
⚠ Common exam trap
A common mix-up: candidates confuse NSG flow logs (which log network traffic) with the Activity Log (which logs configuration changes), leading candidates to select NSG flow logs instead of diagnostic settings on the Activity Log.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Diagnostic settings on the Azure Activity Log
Diagnostic settings on the Azure Activity Log capture all control-plane operations, including changes to NSGs (e.g., rule additions or deletions). By configuring a diagnostic setting to stream the Activity Log to a Log Analytics workspace, you ensure that every NSG modification is automatically logged and centralized for monitoring and alerting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Diagnostic settings on the Azure Activity Log
Why this is correct
Diagnostic settings on the Azure Activity Log are the correct mechanism because the Activity Log itself records every control-plane operation—such as resource creation, deletion, and configuration changes—for your Azure resources. By configuring a diagnostic setting on this log, you can stream those management events directly into a Log Analytics workspace, enabling centralized querying, alerting, and long-term retention for security auditing. This is the built-in, supported way to capture and route resource-level change activity to your security monitoring pipeline.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is a governance and compliance engine that enforces rules on resources and can evaluate whether a resource is compliant with those rules. However, it does not automatically send logs to a Log Analytics workspace—it only generates compliance data and can trigger remediation tasks or deny non-compliant deployments. For actual log routing and centralization, you must configure diagnostic settings, so Policy alone cannot satisfy the requirement to forward security logs.
- ✗
NSG flow logs
Why it's wrong here
NSG flow logs are designed to capture network traffic that is allowed or denied by a Network Security Group, providing visibility into IP flows and connection summaries. They do not record changes to the NSG itself or other control-plane events, so they cannot help you monitor who modified a resource or when. Because the goal involves auditing resource-level changes rather than network traffic patterns, flow logs are the wrong tool for this scenario.
- ✗
Azure Monitor alerts
Why it's wrong here
Azure Monitor alerts are a reactive notification mechanism that triggers actions when a condition on metrics, logs, or the Activity Log is met. Alerts themselves do not ingest, centralize, or forward logs to a workspace—they consume data that already exists and send notifications or run automation. To route the Activity Log to a Log Analytics workspace, you need a diagnostic setting, not an alert rule.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.