Plan and manage an Azure AI solution 1.4 Implement responsible AI across generative AI and agentic systems

Compliance needs a record of administrative operations on a Foundry resource, such as…

Study guide skill: Implement auditing through trace logging, provenance metadata, and approval workflows

Question B8-012

Compliance needs a record of administrative operations on a Foundry resource, such as deployments, configuration changes, and access control events, kept in Azure Storage for policy audit. Which two steps meet this? (Choose two.)

Select 2 answers.

  • A Collect only the RequestResponse category, which records administrative operations
  • B Nothing, because resource logs are saved and queryable automatically without a diagnostic setting
  • C Use a storage account in the same subscription, because a different subscription isn't allowed
  • D Add a diagnostic setting on the Foundry resource that collects the Audit log category ✓ Correct answer
  • E Choose Archive to a storage account as a destination; the audit records land in their own insights-logs-audit container ✓ Correct answer

Answer: D, E

Audit logs record administrative operations such as deployments, configuration changes, and access control events, and you must route resource logs with a diagnostic setting to save or query them. Archiving to Azure Storage retains logs for policy audit, with each category in its own insights-logs-<category> container. RequestResponse logs cover inference requests, and the storage account can be in another subscription if you have RBAC access to both.

Deep dive

How it works

Foundry Models emit several resource log categories. The two that matter here:

  • Audit: administrative operations such as deployments, configuration changes and access control events. That's the compliance record.
  • RequestResponse: logs for every inference request and response, including status codes and latency.

Logs aren't kept by default. They're generated automatically, but you must route them with a diagnostic setting to save or query them. On the Foundry resource, add a diagnostic setting, select Audit Logs, and choose Archive to a storage account. Azure Storage is the destination Microsoft describes for retaining diagnostic logs for policy audit, static analysis or backup.

In the storage account, Azure Monitor writes log records as JSON blobs, and each log category gets its own container named insights-logs-<category>, for example insights-logs-audit.

The storage account doesn't need to be in the same subscription as the resource, as long as whoever configures the setting has RBAC access to both subscriptions.

The other options, and when you'd use them

  • Only RequestResponse: RequestResponse covers inference requests and responses. Administrative operations are in the Audit category.
  • Nothing, logs are saved automatically: Logs are generated automatically, but you must route them with a diagnostic setting to save or query them.
  • Same subscription required: It isn't. A different subscription works with RBAC access to both.

Exam tip

Admin activity = Audit category. Keep it = diagnostic setting → Archive to a storage account (insights-logs-audit). Inference traffic = RequestResponse.

References

Last reviewed:

Ready to test yourself? The quiz asks this and every other AI-103 question, with instant feedback. Practice this in a quiz →

All Plan and manage questions · AI-103 study guide

Thanks for your feedback!