The correct answer is Store the subscription keys in Azure Key Vault.

Storing keys in Key Vault centralizes secret management and gives the operations team a place to collect and audit access events. Key Vault emits diagnostic logs for secret reads and you can route those logs to Log Analytics or another sink to query how often a secret was retrieved and which identity performed the read.

Enable diagnostic settings to send logs to Log Analytics is incorrect because enabling diagnostics on the cognitive service itself will not record accesses to subscription keys unless the keys are stored and accessed from a resource that emits those secret access logs. You must store the secrets where access events are generated.

Rotate the subscription keys on a monthly cadence is incorrect because rotation improves security but it does not provide visibility into how often keys are retrieved. Rotation does not answer the monitoring question.

Create an Azure Monitor alert for the cognitive service is incorrect because alerts on the cognitive service will monitor service metrics and logs but they will not report secret retrievals unless those retrieval events are logged by the service that stores the keys and an appropriate diagnostic pipeline and alert rule are configured there.

Full AWS Practitioner Certification Question