{"question":{"id":42299,"htmlId":"question42299","kind":"SingleChoice","specVersion":null,"questionHtml":"

Your organization uses Microsoft Fabric workspaces backed by a capacity in the F64 SKU. As a Fabric administrator, you need to set up a near real-time feed of all workspace-level activities-such as item creation, permission changes, and publish operations-so that your Security Operations Center (SOC) can query the data with Kusto Query Language (KQL) and build custom alerts. Which action should you perform first to meet this requirement?

","descriptionHtml":"

To stream Fabric workspace activities into a target that supports ad-hoc KQL queries, you must configure an Azure Monitor diagnostic setting for the capacity (or individual workspace) and route the Fabric Activity log to Log Analytics. Enabling the diagnostic setting is the prerequisite that turns on continuous export; once the data reaches the Log Analytics workspace, the SOC team can query it with KQL or connect Sentinel for alerting. Downloading the admin audit log provides only a static file, not a streaming feed. Assigning the Log Analytics Contributor role does not itself activate logging. Creating a deployment pipeline does not generate or stream activity logs.

","answers":[{"id":2585665,"html":"

Create an Azure Monitor diagnostic setting on the Fabric capacity or workspace and send the Fabric Activity log to a Log Analytics workspace.

","isCorrect":true},{"id":2585667,"html":"

Assign the Log Analytics Contributor role to the SOC analysts on the Fabric workspace.

","isCorrect":false},{"id":2585668,"html":"

Create a deployment pipeline and enable its workspace usage metrics dataset for the SOC team.

","isCorrect":false},{"id":2585666,"html":"

Download the Power Platform admin audit log and schedule a notebook to upload the file to a Kusto database.

","isCorrect":false}],"textInput":null,"matching":null,"objectiveId":1969,"objectiveTitle":"Implement and manage an analytics solution","nextQuestionUrl":"/study/questions/dp-700/you-must-transform-200-gb-of-semi-structured-logs-in-onelake-engineers/42507?HideScore=false&ObjectiveMode=RoundRobbinObjectives","questionUrl":"/study/questions/dp-700/your-organization-uses-microsoft-fabric-workspaces-backed-by-a-capacity-in/42299","followUpPrompts":[{"id":281838,"prompt":"How do I configure an Azure Monitor diagnostic setting on a Fabric capacity to send Fabric Activity logs to a Log Analytics workspace?","response":"Steps (Azure portal): 1) Open the Azure Portal and go to the Fabric capacity resource (or the individual Fabric workspace resource). 2) In the left menu, select “Diagnostic settings.” 3) Click “+ Add diagnostic setting.” 4) Give the setting a name, select the Fabric Activity log category (or the categories you need). 5) Under “Destination details” choose “Send to Log Analytics” and select the target Log Analytics workspace. 6) Save the diagnostic setting. Permissions: you need permission to create diagnostic settings on the Fabric resource (Microsoft.Insights/diagnosticSettings/write — typically Contributor or Owner on the capacity) and sufficient access on the Log Analytics workspace to receive data (Log Analytics Contributor or Owner on the workspace). Notes: diagnostic settings enable continuous export/streaming of Fabric Activity into Log Analytics (near real-time). You can also route the same logs to Event Hubs or Storage if needed for other integrations."},{"id":281839,"prompt":"What are example KQL queries SOC can use in Log Analytics to find item creations, permission changes, and publish operations?","response":"When Fabric Activity is sent to Log Analytics it appears in AzureDiagnostics (or a similarly named table) with fields like TimeGenerated, Resource, OperationName, Caller, and ResultType. Example queries: - Item creations (create/new operations): AzureDiagnostics | where Category == "FabricActivity" | where OperationName has_cs "Create" or OperationName has_cs "New" | project TimeGenerated, Resource, OperationName, Caller, ResultType | sort by TimeGenerated desc - Publish operations (deploy/publish): AzureDiagnostics | where Category == "FabricActivity" | where OperationName has_cs "Publish" or OperationName has_cs "Deploy" | project TimeGenerated, Resource, OperationName, Caller, ResultType - Permission/role changes (look for update operations mentioning role/permission): AzureDiagnostics | where Category == "FabricActivity" | where OperationName has_cs "Update" or OperationName has_cs "Set" | where tostring(Message) has_cs "permission" or tostring(Message) has_cs "role" | project TimeGenerated, Resource, OperationName, Caller, Message Adjust field names (Message, OperationName) to match your ingestion schema. Use | where ResultType != "Success" to surface failures and build alerts from these queries. KQL = Kusto Query Language."},{"id":281840,"prompt":"What’s the difference between Fabric Activity logs and the Power Platform admin audit log, and why choose diagnostic settings?","response":"Key differences: - Fabric Activity logs (Azure Monitor diagnostic settings) are resource-level telemetry exported continuously (streaming) from Fabric capacities or workspaces into targets such as Log Analytics, Event Hubs, or Storage. They enable near real-time querying with KQL and immediate alerting (ideal for SOC use cases). - Power Platform admin audit logs are tenant audit exports (audit trail) you can download or ingest, but the downloadable admin audit log is typically a static file or batched export — not designed for continuous near real-time streaming and ad-hoc KQL queries. Why diagnostic settings: enabling a diagnostic setting is the prerequisite that turns on continuous export of Fabric Activity. That stream to Log Analytics allows SOC teams to query with KQL, build real-time alerts, and integrate with SIEMs (e.g., Microsoft Sentinel). Assigning roles alone or creating deployment pipelines does not enable continuous activity streaming."}],"presentationMode":false,"hideFeedbackForm":false,"hideResponseBadges":false,"setId":null,"skipSaveResponse":false},"canVote":false,"streak":{"value":null,"title":null,"launchConfetti":false,"isRecord":false},"id":"crucial-react-0e8086f48e3d46d4acfb0e3172cd8b80"}

Microsoft Fabric Data Engineer Associate DP-700 Practice Question

Report Issue