You have an Azure Key Vault named `Vault1` in a production environment.
You need to implement a logging solution for `Vault1` that meets the following requirements:
1. All access attempts and operations on keys, secrets, and certificates must be recorded.
2. The collected logs must be queryable using Kusto Query Language (KQL).
3. The logs must be retained for 365 days.
4. Administrative effort and costs must be minimized.
Which two configurations should you select? (Choose two.)
- A diagnostic setting on `Vault1` that routes the `AuditEvent` logs to a Log Analytics workspaceAnswer
- A data retention period of 365 days configured on the destination Log Analytics workspaceAnswer
- CA diagnostic setting on `Vault1` with the retention policy (days) setting configured to 365 days
- DA diagnostic setting on `Vault1` that routes the `AuditEvent` logs to an Azure Storage account configured with a lifecycle management policy
- EA diagnostic setting on `Vault1` that routes all metrics to an Azure Event Hub
Answer
To meet the requirements, you must create a diagnostic setting on the Key Vault that routes the `AuditEvent` logs to a Log Analytics workspace, and then configure the data retention period of that destination Log Analytics workspace to 365 days.
To record operations on Key Vault assets, you must select the `AuditEvent` category. To query these logs with KQL, they must be sent to a Log Analytics workspace. Because Azure has retired the retention setting in diagnostic settings, you must configure the 365-day retention directly on the Log Analytics workspace destination.
Step-by-Step Solution
Key Concept
Azure Monitor diagnostic settings send logs to supported destinations. When using a Log Analytics workspace for KQL analysis, log retention must be managed at the workspace level because the diagnostic setting's internal retention policy is retired.