SC-200 Certification Practice Question #74

Question

You have an Azure subscription that uses Microsoft Defender for Cloud and contains a storage account named storage1.

You receive an alert that there was an unusually high volume of delete operations on the blobs in storage1.

You need to identify which blobs were deleted.

What should you review?

Accepted Answer

Identifying *which specific blobs* were deleted requires per-object data-plane logging. Azure Storage Analytics / Storage resource logs record each DeleteBlob REST operation with the target blob URI, which is exactly what answers "which blobs" — MS Learn even shows filtering Storage logs by `OperationName = Delete Blob` to find deleted items. The official Suggested Answer and the clear plurality (27 votes) both choose B, and the activity log (A) only captures management-plane changes, so it cannot list deleted blobs. Confidence is held at 78% because a sizeable minority argues D ("Related entities"), which can surface the affected resource but is not the authoritative per-blob enumeration the question demands; MS Learn breaks the tie toward the Storage logs.

More SC-200 practice questions