Your company must meet strict audit requirements for Azure Virtual Desktop: capture connection, host, and management logs centrally for seven years, and reduce the risk of data exfiltration from sessions. Which two actions should you implement? Each correct answer presents part of the solution.

Enabling Azure Virtual Desktop diagnostic settings for host pools, workspaces, and application groups allows you to capture crucial connection, host, and management logs. Sending these to a Log Analytics workspace, configured with a long-term retention strategy like archiving to Azure Storage, ensures compliance with the seven-year audit requirement. Configuring host pool RDP properties to disable clipboard and drive redirection significantly reduces the risk of data exfiltration by preventing users from copying data out of the virtual desktop session or transferring files to local drives. Enabling watermarking and screen capture protection further enhances data security by deterring and preventing unauthorized data capture. Boot diagnostics are for troubleshooting VM startup issues, not central logging or data exfiltration prevention. Just-In-Time VM access is for securing management ports, not session data. Azure Activity Logs provide management plane insights but lack the detailed session and host-level data needed for comprehensive AVD auditing.