A company has an Azure subscription. They have around 50 virtual machines defined as part of the subscription. Azure Diagnostics have been enabled on all of the virtual machines. You have to get the…

Question

Options

• AActivity Log
• BLogs
• CMetrics
• DService Health

• A
  4% (1)
• B
  91% (21)
• C
  4% (1)

Explanation

Option B (Logs) is correct because Azure Monitor Logs (powered by Log Analytics) allows you to query detailed diagnostic and security event data collected from virtual machines using the Kusto Query Language (KQL). Since Azure Diagnostics is already enabled, security events are ingested into the Log Analytics workspace and can be queried and analyzed in depth.

Why the others are wrong:

• A (Activity Log) tracks subscription-level management operations (like who stopped a VM), not granular OS-level security events - it's actually the right tool for the other requirement in this scenario.
• C (Metrics) captures numerical performance data (CPU, memory, disk) at regular intervals and is not designed for querying security event logs.
• D (Service Health) monitors the health of Azure services and infrastructure globally, not individual VM security events.

Memory Tip: Think of it this way - Logs = deep dive queries (security events, custom searches), Activity Log = who did what at the subscription level, and Metrics = numbers over time. If the question mentions "query" + "security events," always think Logs (Log Analytics).

No community discussion yet for this question.