Examkin

Question

Difficulty: MediumAzure Monitor Metrics and Diagnostic Settings

You have an Azure SQL Database named `sqldb-sales`. You need to configure diagnostic logging to satisfy the following requirements:
- Send the SQL database audit logs (`SQLSecurityAuditEvents`) to a Log Analytics workspace named `law-security` for querying.
- Send the database performance metrics (`Basic`) to an Azure storage account named `stvalaudit` for long-term archiving.
- Minimize data ingestion costs by ensuring log data is not sent to the storage account and metric data is not sent to the Log Analytics workspace.

Which configuration should you implement?

  1. A
    Create a single diagnostic setting that routes both `SQLSecurityAuditEvents` and `Basic` metrics to both the Log Analytics workspace and the storage account.
  2. B
    Create a single diagnostic setting that routes `SQLSecurityAuditEvents` to the Log Analytics workspace, and configure the database backup settings to export performance metrics to the storage account.
  3. Create two separate diagnostic settings: one that routes `SQLSecurityAuditEvents` to the Log Analytics workspace, and another that routes `Basic` metrics to the storage account.Answer
  4. D
    Create a single diagnostic setting routing all diagnostic data to the Log Analytics workspace, and configure an Azure Storage lifecycle management policy to copy metrics from the workspace to the storage account.

Answer

Create two separate diagnostic settings: one that routes the SQL database audit logs to the Log Analytics workspace, and another that routes the database performance metrics to the storage account.
A single Azure diagnostic setting routes all selected log categories and metrics to all configured destinations. To route audit logs (`SQLSecurityAuditEvents`) exclusively to the Log Analytics workspace and performance metrics (`Basic`) exclusively to the storage account without sending unwanted data to either destination, you must create two separate diagnostic settings. Azure resources support configuring up to 5 diagnostic settings.

Step-by-Step Solution

1
Analyze how diagnostic settings handle routing when multiple categories and destinations are selected within the same setting.
Recognize that a single diagnostic setting operates as a broadcast mechanism, sending all selected logs and metrics to all specified destinations.
This dictates that selecting both the Log Analytics workspace and the storage account in one setting would result in all logs and metrics being sent to both locations, incurring unnecessary costs.
2
Determine if Azure resources support multiple diagnostic settings to split routing.
Confirm that Azure resources support up to 5 diagnostic settings, allowing separate settings to be applied to the same resource.
This capability allows configuring distinct routing paths for different categories of logs and metrics.
3
Design the configuration with separate settings to meet the isolation and cost requirements.
Create one setting for `SQLSecurityAuditEvents` targeting the workspace, and a second setting for `Basic` metrics targeting the storage account.
This satisfies the scenario requirements while preventing cross-routing and minimizing data ingestion costs.

Key Concept

Routing different diagnostic logs and metrics to different destinations using multiple diagnostic settings.
Rate this question

Topics

Azure Monitor Metrics and Diagnostic Settings

More questions from this topic