Security wants an audit trail answering 'who deleted this resource group and when' — control-plane operations at the subscription level. Which provides this?
A.Azure Monitor metrics
Metrics are numeric performance data — no audit info.
B.Azure Activity Log
Activity Log = control-plane audit trail. Correct.
C.NSG flow logs
Flow logs capture network traffic — unrelated.
D.Resource health
Resource health reports platform-caused availability issues, not user actions.
Why this answer
The Activity Log records all control-plane (ARM) operations — creates, deletes, updates, RBAC changes — per subscription, retained 90 days. Data-plane access (reading blobs) requires diagnostic settings or Storage analytics, not the Activity Log.
Correct answer: B · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Monitoring & Backup practice session.
Practice Monitoring & Backup