Examkin

Question

Difficulty: MediumAzure Monitor Metrics and Diagnostic Settings

You have an Azure App Service named App1. You need to configure a diagnostic setting for App1 to meet the following requirements:
- Retain App Service HTTP logs for a minimum of 365 days at the lowest possible cost.
- Perform interactive analysis of performance metrics using Kusto Query Language (KQL) queries.
Which two destinations should you configure in the diagnostic setting? Select two.

  1. A Log Analytics workspaceAnswer
  2. An Azure Storage accountAnswer
  3. C
    An Azure Event Hub
  4. D
    An Azure Recovery Services vault

Answer

Configure a Log Analytics workspace for KQL query capabilities, and an Azure Storage account for low-cost, long-term 365-day retention.
Configuring a Log Analytics workspace allows you to run interactive Kusto Query Language (KQL) queries on diagnostic data. Configuring an Azure Storage account allows you to store the diagnostic logs for long-term archiving (such as 365 days) at a lower cost than active Log Analytics retention.

Step-by-Step Solution

1
Analyze the requirement for running KQL queries.
Identify that a Log Analytics workspace is the destination that supports interactive querying using Kusto Query Language (KQL).
Log Analytics workspaces natively support Azure Monitor Logs and the KQL query engine.
2
Analyze the requirement for retaining logs for a minimum of 365 days at the lowest cost.
Identify that an Azure Storage account is the standard, most cost-effective destination for archiving diagnostic logs long-term.
Storage accounts offer the lowest cost tier (cool or archive) for storing large volumes of static log files over long periods compared to Log Analytics active retention or Event Hubs.
3
Evaluate the distractors against the requirements.
Eliminate the Event Hub (used for streaming to external SIEMs) and Recovery Services vault (used for backups, not diagnostic settings).
Neither Event Hubs nor Recovery Services vaults satisfy the requirements for direct KQL analysis and low-cost long-term log retention.

Key Concept

Azure Monitor diagnostic settings support sending platform logs and metrics to a Log Analytics workspace (for querying and analysis), an Azure Storage account (for archiving), an Event Hub (for streaming), or Azure Monitor Metrics.
Estimated Time:1m 30s
Rate this question

Topics

Azure Monitor Metrics and Diagnostic Settings

More questions from this topic