Microsoft Azure Security Technologies — Question 45

After creating a new Azure subscription, you are tasked with making sure that custom alert rules can be created in Azure Security Center.
You have created an Azure Storage account.
Which of the following is the action you should take?

Answer options

• A. You should make sure that Azure Active Directory (Azure AD) Identity Protection is removed.
• B. You should create a DLP policy.
• C. You should create an Azure Log Analytics workspace.
• D. You should make sure that Security Center has the necessary tier configured.

Correct answer: C

Explanation

The correct action is to create an Azure Log Analytics workspace, as this is essential for enabling custom alert rules in Azure Security Center. The other options, such as removing Azure AD Identity Protection or creating a DLP policy, do not directly relate to the capability of setting alert rules, and ensuring the correct Security Center tier is set alone does not suffice without the Log Analytics workspace.