Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
B - To identify which blobs were deleted from a storage account like storage1, you need to review Azure Storage Analytics logs, specifically the Blob service logs. These logs provide detailed information about: REST API operations (e.g., DeleteBlob) Request timestamps Caller IP addresses Authentication types Target blob URIs This is the only logging mechanism that captures per-blob operations, including deletes, which is what you need in this scenario. D is not correct because although, it might show the user or IP address involved, it does not show the specific blobs affected.
A - After much deliberation, it looks like I am going with A. This is from Co-pilot: While Azure Storage Analytics logs do track operations for Blob, Queue, and Table services, the key distinction here is what data they capture versus what the activity logs provide. Why Activity Logs Were the Best Answer: - Storage Analytics logs track individual requests, such as reads, writes, and errors, but they don’t provide a direct list of deleted blobs in an accessible format. - Azure Activity Logs, however, record administrative actions, such as deletion events, making them more useful for identifying which blobs were deleted and who deleted them.
Co-pilot states: To identify which blobs were deleted in the storage account named storage1 after receiving an alert about an unusually high volume of delete operations, you should review: B. the Azure Storage Analytics logs These logs provide detailed information about the operations performed on the storage account, including which blobs were deleted.