Investigators need resource operation evidence in a central analysis destination. Which configuration should be evaluated?

1. Only a larger compute tier
2. Only a resource naming standard
3. Logging every raw secret as the only diagnostic method
4. Appropriate diagnostic settings and supported log categories with controlled retention