Examkin

Question

Difficulty: MediumAzure Monitor Metrics and Diagnostic Settings

An administrator is configuring monitoring for an Azure Firewall named `fw-corp-prod`. The organization's security policy requires:

* Streaming all firewall activity logs to a third-party Security Information and Event Management (SIEM) system in real-time.
* Archiving the logs for 365365 days for regulatory compliance at the lowest possible storage cost.

Which configuration in the diagnostic settings of `fw-corp-prod` meets these requirements?

  1. Configure the diagnostic setting to stream logs to an Azure Event Hubs namespace and archive logs to an Azure Storage account.Answer
  2. B
    Configure the diagnostic setting to send logs to an Azure Log Analytics workspace and configure the workspace retention period to 365365 days.
  3. C
    Configure the diagnostic setting to archive logs to an Azure Storage account, and then create a scheduled Azure Automation runbook to export the logs to the SIEM.
  4. D
    Configure the diagnostic setting to send logs to an Azure Event Hubs namespace, and configure the Event Hub message retention period to 365365 days.

Answer

Configure the diagnostic setting to stream logs to an Azure Event Hubs namespace and archive logs to an Azure Storage account.
The correct configuration is to stream logs to an Azure Event Hubs namespace and archive them to an Azure Storage account. This satisfies the real-time integration requirement with the SIEM via Event Hubs while utilizing the lowest-cost storage option (Azure Storage) for the 365365-day retention requirement.

Step-by-Step Solution

1
Identify the real-time streaming requirement.
Azure Event Hubs must be used as a destination in the diagnostic setting to facilitate real-time ingestion by the third-party SIEM.
Log Analytics and Storage Accounts do not natively push logs to external SIEMs in real-time.
2
Identify the long-term archiving requirement at the lowest cost.
An Azure Storage account must be used to archive logs for 365365 days.
Azure Storage provides the most cost-effective cold storage tier compared to Log Analytics workspaces.
3
Combine the destinations in a diagnostic setting.
A diagnostic setting configured with both the Event Hubs namespace and the Storage account destinations.
Azure Monitor diagnostic settings allow selecting multiple destinations simultaneously to satisfy different retention and integration needs.

Key Concept

Selecting the appropriate destination for Azure Monitor diagnostic settings based on retention, cost, and analysis requirements.
Estimated Time:1m 30s
Rate this question

Topics

Azure Monitor Metrics and Diagnostic Settings

More questions from this topic