A security team needs to audit all access to Azure Key Vault secrets used by Azure AI services. They want to generate alerts when a secret is accessed more than 100 times within one minute, which may indicate unauthorized automated secret scraping. Which Azure service combination achieves this monitoring and alerting?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because enabling Azure Key Vault diagnostic logging sends audit events (including secret access operations like SecretGet) to a Log Analytics workspace. An Azure Monitor alert rule can then run a KQL query that counts SecretGet events per minute per source and fires an alert when the count exceeds 100 within one minute, enabling detection of automated secret scraping.
Full explanation below image
Full Explanation
A is correct because enabling Azure Key Vault diagnostic logging sends audit events (including secret access operations like SecretGet) to a Log Analytics workspace. An Azure Monitor alert rule can then run a KQL query that counts SecretGet events per minute per source and fires an alert when the count exceeds 100 within one minute, enabling detection of automated secret scraping. B is wrong because Microsoft Defender for Key Vault generates alerts for anomalous patterns using built-in machine learning, but does not support custom threshold-based alert rules (e.g., exactly >100 accesses per minute). C is wrong because Azure Policy audit effects evaluate resource configuration compliance, not runtime access event patterns like secret access frequency. D is wrong because Azure Activity Logs capture management plane operations (Key Vault resource creation, key policy changes), not data plane operations (secret reads, certificate downloads)—those require Key Vault diagnostic logs.