Which alert would best detect credential misuse?
- A An alert on AuditEvent logs showing secret reads from unexpected identities or IP ranges (correct answer)
- B CPU alert on the vault
- C Storage capacity alert
- D Cost alert
Shortcut: Key Vault has no CPU or capacity to monitor. Anomalous data-plane access patterns in AuditEvent logs are the meaningful security signal.