What should you recommend?

DRAG DROP
You need to ensure that operational and security requirements are met.
What should you recommend? To answer, drag the appropriate log approaches to the correct locations. Each log approach may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Correct Answer:

Explanation/Reference:
Explanation:
Box 1: Log to Azure Event Hubs
Cosmost DB logs can be send logs to Azure Storage, can be streamed to Azure Event Hubs, and be exported to Azure Log Analytics.
Box 2: Process Logs with Azure functions
Azure Data Factory Diagnostic logs
Save them to a Storage Account for auditing or manual inspection. You can specify the retention time (in days) using the diagnostic settings.
Stream them to Event Hubs for ingestion by a third-party service or custom analytics solution such as PowerBI.
Analyze them with Log Analytics
Scenario:
All application logs, diagnostic data, and system monitoring must be available in a single location.
Logging and diagnostic information must be reliably processed.
Security and Personally Identifiable Information (PII)
All access and usage of analysis results must be logged. Any unusual activity must be detected.
Reference:
https://docs.microsoft.com/en-us/azure/cosmos-db/logging
https://docs.microsoft.com/en-us/azure/data-factory/monitor-using-azure-monitor