SC-100 Certification Practice Question #149

Question

You are planning the security requirements for Azure Cosmos DB Core (SQL) API accounts.
You need to recommend a solution to audit all users that access the data in the Azure Cosmos DB accounts.
Which two configurations should you include in the recommendation? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

The requirement is to audit all users who access the data. Two log sources are needed: Microsoft Entra (Azure AD) sign-in logs sent to Log Analytics answer "who authenticated" (A), and Azure Cosmos DB resource/diagnostic logs sent to Log Analytics — specifically DataPlaneRequests, whose category is "Audit" — answer "what data was accessed and by which operation" (C). The 57-vote majority and the top 👍28 comment select AC. The Suggested Answer lists only C, which is incomplete for a two-answer question; A supplies the user-identity half. The strong AD minority argues for disabling local authentication, but that is an access-control hardening step, not an auditing configuration, and the scenario does not require enforcing Entra-only auth — so it is discounted. Confidence is held at 84 because the official Suggested Answer (C-only) does not fully corroborate A, and there is a sizable, reasoned AD/CE community split.

More SC-100 practice questions