Examkin

Question

Difficulty: MediumAzure Monitor Metrics and Diagnostic Settings

You have an Azure Application Gateway named `appgw-prod` that has Web Application Firewall (WAF) enabled.

You need to collect the WAF firewall logs to meet the following requirements:
- Run interactive KQL queries on the logs inside the Azure portal.
- Stream the logs to an external, third-party Security Information and Event Management (SIEM) system in real-time.

Which diagnostic settings configuration should you implement for `appgw-prod`?

  1. A
    Create a single diagnostic setting. Select the `ApplicationGatewayFirewallLog` log category, and configure the destinations to send to both a Storage account and an Event Hub.
  2. Create a single diagnostic setting. Select the `ApplicationGatewayFirewallLog` log category, and configure the destinations to send to both a Log Analytics workspace and an Event Hub.Answer
  3. C
    Create a single diagnostic setting. Select the `ApplicationGatewayFirewallLog` log category, and configure the destinations to send to both a Log Analytics workspace and a Storage account.
  4. D
    Create a single diagnostic setting. Select the `ApplicationGatewayFirewallLog` log category, send the logs to a Storage account, and assign the Reader role to the SIEM service principal on the storage account.

Answer

Create a single diagnostic setting. Select the ApplicationGatewayFirewallLog log category, and configure the destinations to send to both a Log Analytics workspace and an Event Hub.
To satisfy both requirements, the firewall logs must be sent to a Log Analytics workspace for interactive KQL querying and to an Event Hub for real-time streaming to a third-party SIEM. Azure Monitor diagnostic settings allow selecting multiple destinations within a single configuration.

Step-by-Step Solution

1
Determine the destination needed for running interactive KQL queries.
Log Analytics workspace is identified as the required destination.
Only Log Analytics workspaces support native KQL queries in Azure Monitor.
2
Determine the destination needed for streaming logs to an external third-party SIEM in real-time.
Event Hub is identified as the required destination.
Event Hubs are designed to ingest and stream telemetry data to external systems in near real-time.
3
Configure the diagnostic setting on the Application Gateway resource.
A single diagnostic setting is created with the ApplicationGatewayFirewallLog category selected and both Log Analytics and Event Hub checked as destinations.
Azure diagnostic settings support sending selected log categories to multiple destinations simultaneously.

Key Concept

Azure Monitor diagnostic settings allow you to route resource logs to different destinations (Log Analytics workspaces, Storage accounts, Event Hubs, or partner solutions) depending on your querying, retention, and integration requirements.
Rate this question

Topics

Azure Monitor Metrics and Diagnostic Settings

More questions from this topic