How can you audit which identity performed a privileged operation last week?
- A Query the Azure Activity log for the operation and caller (correct answer)
- B Check resource tags
- C Look at Azure Advisor
- D Inspect the resource's properties
Shortcut: The Activity log records management-plane operations with caller identity, timestamp, and outcome. Routing it to Log Analytics makes it queryable and retainable.