Investigators need evidence of Azure Resource Manager operations such as resource deletion. Which log is a primary source?

1. Azure Activity Log
2. Only a VM's current CPU metric
3. Only database query result rows
4. A storage access tier