Examkin

Question

Difficulty: MediumAzure Monitor Metrics and Diagnostic Settings

You have an Azure Key Vault named `kv-finance`.

You need to configure diagnostic logging for `kv-finance` to satisfy the following requirements:
- All key vault access logs (`AuditEvent`) must be queryable using KQL.
- The logs must be archived for 365 days to meet compliance regulations.
- Storage costs for the archived logs must be minimized.

Which configuration should you implement?

  1. Create a single diagnostic setting on `kv-finance` to send `AuditEvent` logs to a Log Analytics workspace and an Azure Storage account. Configure a lifecycle management policy on the storage account to delete data after 365 days.Answer
  2. B
    Create a diagnostic setting on `kv-finance` to send `AuditEvent` logs to a Log Analytics workspace, and configure a 365-day retention period within the diagnostic setting.
  3. C
    Create a diagnostic setting on `kv-finance` to send `AuditEvent` logs to an Azure Event Hub. Configure the event retention on the Event Hub namespace to 365 days.
  4. D
    Create a diagnostic setting on `kv-finance` to send `AllMetrics` and `AuditEvent` logs to a Log Analytics workspace. Set the workspace default retention to 365 days.

Answer

Create a single diagnostic setting on the Key Vault to send the audit logs to both a Log Analytics workspace and an Azure Storage account, then configure a lifecycle management policy on the storage account to manage the 365-day retention.
The correct configuration uses a single diagnostic setting to send the logs to both the Log Analytics workspace (for queryability) and the Azure Storage account (for low-cost archiving). Since Azure Monitor diagnostic settings no longer support direct retention settings, configuring a lifecycle management policy on the storage account is the correct way to delete logs after 365 days.

Step-by-Step Solution

1
Determine the logging requirements for KQL analysis.
Identify that logs must be sent to a Log Analytics workspace to enable KQL querying.
Log Analytics is the only Azure Monitor destination that supports running KQL queries directly on the diagnostic logs.
2
Determine the archiving and retention strategy.
Identify that logs must be sent to an Azure Storage account for long-term archiving to minimize costs, and that retention must be configured via storage lifecycle management.
Log Analytics retention is expensive for long-term archiving (365 days), and diagnostic settings have deprecated direct retention configurations. Azure Storage with lifecycle policies is the cost-effective and supported solution.
3
Select the correct diagnostic settings configuration.
Select the option that routes the logs to both destinations in a single diagnostic setting and uses storage lifecycle rules for retention.
This satisfies all requirements of queryability, retention duration, and cost minimization while aligning with current Azure capabilities.

Key Concept

Azure Monitor diagnostic settings support routing resource logs to multiple destinations, including Log Analytics workspaces for querying and Storage accounts for cost-effective long-term retention using lifecycle management rules.
Rate this question

Topics

Azure Monitor Metrics and Diagnostic Settings

More questions from this topic