A company deploys a Network Security Group (NSG) named `NSG-Secure`. You are tasked with configuring a diagnostic setting on `NSG-Secure` to meet the following requirements:
- Route NSG rule evaluation events to a storage account named `storeauditprod`.
- Avoid routing any performance metrics or flow logs to the storage account.
- Ensure that the configuration uses the minimum required log categories.
Which configuration should you apply to the diagnostic setting?
- Enable the NetworkSecurityGroupEvent log category and select the Archive to a storage account destination, choosing storeauditprod.Answer
- BEnable the NetworkSecurityGroupRuleCounter log category and select the Archive to a storage account destination, choosing storeauditprod.
- CEnable the NetworkSecurityGroupEvent log category and select the Send to Log Analytics workspace destination, choosing storeauditprod.
- DEnable the NetworkSecurityGroupEvent log category, select the Archive to a storage account destination choosing storeauditprod, and assign the Storage Blob Data Contributor role to the NSG on storeauditprod.
Answer
Enable the NetworkSecurityGroupEvent log category and select the Archive to a storage account destination, choosing storeauditprod.
The correct configuration enables the NetworkSecurityGroupEvent log category and selects the 'Archive to a storage account' destination, choosing the storeauditprod storage account. This satisfies all requirements: NetworkSecurityGroupEvent contains the rule evaluation events, archiving to a storage account is the correct destination type for storeauditprod, and no unnecessary metrics or roles are configured.
Step-by-Step Solution
Key Concept
Azure Monitor Diagnostic Settings routing and NSG log categories configuration.