Q28 Key Vault Domain 4 · 20–25% of exam

What does the Key Vault diagnostic log category 'AuditEvent' capture?

  1. A Performance metrics only
  2. B All data plane operations (get, set, delete, list secret/key/cert) with caller identity, result, and timestamp (correct answer)
  3. C Network traffic only
  4. D Resource Manager operations only

Shortcut: AuditEvent logs capture every data plane operation performed on Key Vault, including who accessed or modified a secret/key/cert, from which IP, and whether it succeeded.