Azure Key Vault Access Review and Cost Minimization
Short answer
C Use Azure Monitor to access the Activity Log and Resource Logs for reviewing Key Vault access events while minimizing costs compared to premium governance tools.
Question
You have an Azure subscription that contains an Azure key vault named KV1. You need to ensure that you can review how and when KV1 is accessed. The solution must minimize costs. What should you use?
Key Takeaways
The question tests the distinction between management-plane logging (Activity Log) and data-plane logging, with a cost constraint favoring built-in logs over paid services like Purview or Sentinel.
This question addresses the correct Azure service for auditing Key Vault data-plane access while optimizing costs. The Activity Log is identified as the correct choice for reviewing how and when KV1 is accessed.
Common mistake: Learners often select Microsoft Purview or Azure Monitor, assuming advanced compliance tools are needed for auditing, but these incur higher costs than the native Activity Log.
Expert Analysis
Why the Answer Is Correct
The correct answer is C (Azure Monitor). In Azure, the Activity Log is part of Azure Monitor and provides a non-editable, immutable log of events for your subscription and resource groups. For Key Vaults, the Activity Log records management plane events (like creating or deleting the vault), which constitutes "how and when" the resource itself was interacted with at the control level. While data-plane access (reading secrets) is recorded in Resource Logs (also accessible via Azure Monitor), the Activity Log is the primary, cost-effective mechanism for tracking resource lifecycle and administrative access without incurring the high costs of third-party SIEMs or specialized compliance suites.Why the Other Options Are Wrong
Microsoft Purview (A) is a comprehensive data governance solution that includes auditing, but it is significantly more expensive and complex than necessary for simple access review. Microsoft Sentinel (D) is a SIEM/SOAR solution that ingests logs from various sources; while it can track Key Vault access, it is designed for threat detection and incident response, making it an over-engineered and costly choice for basic access review. Option B is incorrect because, technically, the "Activity Log" is a component of Azure Monitor, so selecting "Azure Monitor" is the broader, encompassing correct service name in this context, or the question implies using the monitoring suite to view these logs. Note: Some interpretations might argue for Resource Logs specifically, but among the choices, Azure Monitor is the platform that hosts them, whereas Purview/Sentinel are distinct paid services.Community Comment Notes
Community feedback highlights that Key Vault AuditEvent resource logs record data-plane access, noting that "The activity log mainly records management-plane changes." One user suggests routing audit logs to Storage to reduce retention costs, emphasizing the cost-minimization aspect of the question. This aligns with the strategy of using built-in monitoring capabilities rather than premium add-ons.Exam Strategy
Always prioritize native, built-in Azure features (like Activity Log and Resource Logs within Azure Monitor) for logging and monitoring tasks unless specific compliance or advanced threat detection requirements necessitate services like Purview or Sentinel. Consider cost implications carefully when choosing between free/low-cost native logs and paid analytics platforms.
Frequently Asked Questions
Why not use Microsoft Purview for Key Vault auditing?
Purview is a comprehensive governance tool with higher costs. For basic access review, native Azure Monitor logs are sufficient and more cost-effective.
Does the Activity Log show secret reads?
No, the Activity Log primarily shows management-plane events (like vault creation). Data-plane access (secret reads) is in Resource Logs, also under Azure Monitor.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.
From public community threads 1
-
Turnkey 👍 1 Answered CKey Vault AuditEvent resource logs record data-plane access, including secret and key requests. The activity log mainly records management-plane changes; route audit logs to Storage to reduce retention costs.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →