Exam SC-300 topic 3 question 18 discussion

Correct Answer: ✅ C. A Log Analytics workspace Explanation: To analyze Microsoft Entra ID (formerly Azure AD) sign-in logs using Azure Monitor, you need to configure diagnostic settings to send the logs to an appropriate destination. 🔹 Log Analytics workspace is the recommended and most effective destination for analyzing sign-in logs because: It integrates with Azure Monitor and Microsoft Sentinel for advanced security insights. You can run Kusto Query Language (KQL) queries to analyze sign-in patterns and detect anomalies. It supports log retention, alerting, and visualization in Azure Monitor. Why Are the Other Options Incorrect? A. An Azure Event Hub ❌ Used for streaming logs to third-party SIEMs or external systems, not for direct analysis in Azure Monitor. B. An Azure SQL Database ❌ Not supported as a destination for Microsoft Entra sign-in logs. SQL is used for structured data storage, not log analytics. D. An Azure Storage Account ❌ Used for archiving logs, but does not provide built-in analytics, search, or visualization like Log Analytics.