QuestionQ231

Design security solutions for applications and data

You are planning the security requirements for Azure Cosmos DB Core (SQL) API accounts.

You need to recommend a solution that audits every user who accesses data in the Azure Cosmos DB accounts.

Which two configurations should you include in the recommendation? Each correct answer presents part of the solution.

> NOTE: Each correct selection is worth one point.

Choose two
  • A Send the Azure Active Directory (Azure AD) sign-in logs to a Log Analytics workspace.
  • B Enable Microsoft Defender for Identity.
  • C Send the Azure Cosmos DB logs to a Log Analytics workspace.
  • D Disable local authentication for Azure Cosmos DB.
  • E Enable Microsoft Defender for Cosmos DB.
Explanation

Azure Cosmos DB data-plane diagnostic logs sent to a Log Analytics workspace capture every data operation and include the Microsoft Entra principal ID of the caller. Disabling local authentication prevents shared-key access and requires Microsoft Entra identities, enabling access to be attributed to individual users.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!