AZ104-Q: Who created/deleted a resource
Q: You need to audit who created, modified, or deleted a resource and when — the control-plane (management) operations. Which Azure Monitor log provides this?
- A) Activity log ✓
- B) Platform metrics
- C) Diagnostic (resource) logs
- D) Application Insights traces
Answer: A — Activity log. The Activity log records control-plane events — who/what/when a resource was created, updated, or deleted, and state changes — at the subscription level. Platform metrics (B) are numeric performance values, not operations. Diagnostic/resource logs (C) are emitted by a resource about its runtime behavior, not who changed it. Application Insights (D) is app telemetry.
Why it helps
Activity log = control plane / who-did-what. Diagnostic logs = resource runtime. This “what log do I use” distinction is tested.