You are planning the security requirements for Azure Cosmos DB Core (SQL) API accounts. You need to recommend a solution to audit all users that access the data in the Azure Cosmos DB accounts…

Question

Options

• AEnable Microsoft Defender for Cosmos DB.
• BSend the Azure Active Directory (Azure AD) sign-in logs to a Log Analytics workspace.
• CDisable local authentication for Azure Cosmos DB.
• DEnable Microsoft Defender for Identity.
• ESend the Azure Cosmos DB logs to a Log Analytics workspace.

• A
  12% (5)
• B
  81% (35)
• D
  5% (2)
• E
  2% (1)

Explanation

The correct answers are Send Azure AD sign-in logs to a Log Analytics workspace (B) and Disable local authentication for Azure Cosmos DB (C). To audit ALL users accessing Cosmos DB data, you must first eliminate anonymous or key-based access by disabling local authentication (C), forcing all connections through Azure Active Directory identities. Once all access is via Azure AD, sending the Azure AD sign-in logs to Log Analytics (B) captures a complete, auditable record of which users authenticated and when. Together, these two controls ensure every access event is tied to an identifiable identity and is logged. Microsoft Defender for Cosmos DB (A) detects threats but is not primarily an audit logging tool. Defender for Identity (D) monitors on-premises AD, not Cosmos DB. Cosmos DB diagnostic logs (E) capture data-plane operations but would be incomplete if local (key-based) authentication is still enabled, since key access is not tied to user identities.

No community discussion yet for this question.