You have an Azure subscription that contains an Azure SQL database named sql1. You plan to audit sql1. You need to configure the audit log destination. The solution must meet the following…

Question

Options

• Aan event hub
• Ba storage account
• Ca Log Analytics workspace

• A
  15% (4)
• B
  7% (2)
• C
  78% (21)

Explanation

Explanation

A Log Analytics workspace is the correct destination because it natively supports Kusto Query Language (KQL), allowing you to query and analyze audit events directly within Azure Monitor - and configuring it requires minimal administrative effort since it integrates seamlessly with Azure SQL auditing through just a few clicks in the portal.

Event Hub (A) is designed for real-time event streaming and ingestion into third-party tools (like SIEMs), but it does not natively support KQL querying - you'd need additional infrastructure to analyze the data, increasing administrative overhead.

Storage Account (B) stores audit logs as blob files, which require downloading or using additional tools to query - there is no native KQL support, and managing/querying raw files significantly increases administrative effort.

Memory Tip: Think "KQL = Log Analytics" - any time an exam question mentions Kusto Query Language, Log Analytics workspace is almost always the answer. Log Analytics is the home of KQL within the Azure ecosystem.

No community discussion yet for this question.