SC-100 Practice Question: Design solutions that align with security best practices and priorities

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Policy

  Why it's wrong here

  Azure Policy is a governance and compliance service that evaluates resource configurations against defined rules and can enforce or deny non-compliant deployments, but it does not capture a historical record of control-plane operations or the identity of the actor who made them. Its compliance events indicate whether a resource conforms to policy at a moment in time, not a chronological audit trail of every change made to Azure resources. Therefore, while it can alert you to configuration drift, it cannot answer 'what changed, when, and by whom' across all resource types.

• ✓

  Azure Monitor with activity logs

  Why this is correct

  The Azure Activity Log records every control-plane write operation (create, update, delete) on Azure resources, including the caller identity, timestamp, operation name, and resource ID—precisely the data required for change auditing. Azure Monitor provides a unified platform to query and analyze these logs via Log Analytics, configure alerts on specific changes, and export them to storage or event hubs for retention. This combination yields a comprehensive, queryable audit trail of all resource modifications, making it the correct foundational service for auditing every change to Azure resources.

• ✗

  Microsoft Defender for Cloud

  Why it's wrong here

  Microsoft Defender for Cloud is a cloud security posture management (CSPM) and workload protection platform that aggregates security signals to deliver hardening recommendations, vulnerability findings, and threat detection alerts. Although it can ingest resource configuration data and integrate with some activity feeds, its purpose is not to provide a complete per-change audit trail of every Azure resource operation; it focuses on security posture and incidents rather than serving as a change-audit repository. Relying on Defender for Cloud for change auditing would omit the full breadth of control-plane logs and the detailed caller/history information housed natively in the Activity Log.

• ✗

  Microsoft Sentinel

  Why it's wrong here

  Microsoft Sentinel is a cloud-native SIEM and SOAR solution that aggregates security data from diverse sources—including Azure Activity Logs—to detect, investigate, and respond to security incidents at scale. While you technically could connect Sentinel to the Activity Log to support auditing, doing so for basic change auditing introduces significant licensing, infrastructure, and operational overhead, such as analytics rules, workbooks, and log ingestion costs, far exceeding the simple out-of-the-box capability already provided by Azure Monitor. For the fundamental requirement of auditing all changes, you do not need the full incident-detection machinery of a SIEM when the Activity Log plus Log Analytics delivers immediate queryable and alertable change history.

Go deeper

Related to this question