Your company's Azure subscription includes a hundred virtual machines that have Azure Diagnostics enabled.
You have been tasked with retrieving the identity of the user that removed a virtual machine fifteen days ago. You have already accessed Azure Monitor.
Which of the following options should you use?
To identify the user who removed a virtual machine, you should use the Activity Log in Azure Monitor. The Activity Log provides insights into the operations performed on resources within your subscription, including details about actions such as creation, modification, and deletion. It records information about who performed the operation, what action was taken, and when it occurred, which is crucial for auditing and investigating changes in your environment.
# IN EXAM - 29/9/2021 - Pass!
# IN EXAM - 31/8/2021
"Activity logs provides insight into the operations that were performed on resources in your subscription."
C is correct answer
Activity logs provide " insight into the operations on each Azure resource in the subscription from the outside (the management plane) in addition to updates on Service Health events. Use the Activity Log, to determine the what, who, and when for any write operations (PUT, POST, DELETE) taken on the resources in your subscription. There is a single Activity log for each Azure subscription. https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/platform-logs-overview
Use the Activity Log, to determine the what, who, and when...taken on the resources in your subscription. https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/platform-logs-overview
The Activity Log in Azure Monitor provides a comprehensive record of activities performed on resources within your Azure subscription. It includes information about various operations such as creating, modifying, or deleting resources. By querying the Activity Log, you can search for events related to the removal of a virtual machine and identify the user who performed the action.
Activity Log
C is correct
Answer is C
Answer is C
C: Activity Log shows 'management plane' data
CORRECT
C. Activity Log
C is the answer. https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-types#choose-the-right-alert-type - Activity log alert Activity logs provide auditing of all actions that occurred on resources. Use activity log alerts to be alerted when a specific event happens to a resource like a restart, a shutdown, or the creation or deletion of a resource. Service Health alerts and Resource Health alerts let you know when there's an issue with one of your services or resources.
C. Activity Log
arent Activity logs are kept only for 90 days?
The question asks for data 15 days old. Activity logs are retained by default for 30 days(Basic) and 90 days (Standard), but can be setup with longer retention periods if needed.