Exam MS-500 topic 4 question 49 discussion

Actual exam question from Microsoft's MS-500

Question #: 49
Topic #: 4

HOTSPOT -
You have a Microsoft 365 tenant.
You need to retain Azure Active Directory (Azure AD) audit logs for two years. Administrators must be able to query the audit log information by using the Azure
Active Directory admin center.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

Reference:
https://docs.microsoft.com/en-gb/azure/active-directory/reports-monitoring/howto-analyze-activity-logs-log-analytics

by kiketxu at March 17, 2021, 12:31 a.m.

Comments

Submit Cancel

Doinitza

2 years, 4 months ago

In the exam MS-101 the second answer is considered as "Audit logs" and nobody disagree: https://www.examtopics.com/discussions/microsoft/view/84485-exam-ms-101-topic-3-question-122-discussion/

upvoted 1 times

...

LillyLiver

3 years, 2 months ago

The AAD blade to use now is "Log Analytics."

upvoted 4 times

...

mkoprivnj

3 years, 6 months ago

1st - Azure Log Analytics 2nd - Logs

upvoted 3 times

...

kiketxu

4 years, 3 months ago

I would say given answers are correct. To the first, is a clear and common procedure. https://docs.microsoft.com/en-gb/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analytics For the second is a bit tricky question as you can continue seeing the "audit logs" in the AAD blade, but the point of the question is "...to view the saved audit logs". AFAIK you need to use "logs" for this.

upvoted 4 times

moutaz1983

3 years, 10 months ago

Where is this (Logs) section in AD admin center, I believe it is Audit Logs

upvoted 2 times

tlcecertified

3 years, 10 months ago

Wrong, the "Audit Logs" section could not be queried for logs older than 30 days. I believe the provided answer is most appropriate as this questions is testing your ability to integrate Azure AD with Azure Log Analytics, the "Logs" blade is now renamed as "Log Analytics" under the "Monitoring" section.

upvoted 9 times

...