Examkin

Question

Difficulty: MediumAzure Monitor Metrics and Diagnostic Settings

You have an Azure Bastion host named `bastion-corp-east` that is used to manage virtual machines. You must configure diagnostic logging for the Bastion host to meet the following requirements:

* Capture audit logs for all user remote sessions.
* Retain the session logs for 180 days.
* Ensure the logs can be queried directly using the Kusto Query Language (KQL).

Which diagnostic setting configuration should you implement?

  1. Create a diagnostic setting on `bastion-corp-east` that forwards the `BastionAuditLogs` category to a Log Analytics workspace, and set the data retention period of the workspace to 180 days.Answer
  2. B
    Create a diagnostic setting on `bastion-corp-east` that forwards the `AllMetrics` category to a Log Analytics workspace, and set the data retention period of the workspace to 180 days.
  3. C
    Create a diagnostic setting on `bastion-corp-east` that forwards the `BastionAuditLogs` category to an Azure Storage account, and configure a 180-day retention period in the diagnostic setting.
  4. D
    Create a diagnostic setting on `bastion-corp-east` that forwards the `BastionAuditLogs` category to an Azure Event Hub, and configure the message retention period of the hub to 180 days.

Answer

Create a diagnostic setting on `bastion-corp-east` that forwards the `BastionAuditLogs` category to a Log Analytics workspace, and set the data retention period of the workspace to 180 days.
The correct configuration forwards the `BastionAuditLogs` category to a Log Analytics workspace. This workspace natively supports Kusto Query Language (KQL) queries. The data retention period must be managed at the workspace level, which is set to 180 days.

Step-by-Step Solution

1
Identify the correct log category for Azure Bastion session auditing.
The correct log category is `BastionAuditLogs`, which contains remote session connection details.
Tracking user remote sessions requires capturing audit logs rather than performance metrics (`AllMetrics`).
2
Identify the correct destination for querying logs with Kusto Query Language (KQL).
The destination must be a Log Analytics workspace.
Neither Azure Storage accounts nor Azure Event Hubs support direct, native KQL queries on stored log data.
3
Configure the retention settings for the collected logs.
Set the default data retention on the Log Analytics workspace to 180 days.
Diagnostic settings no longer support built-in retention configuration for storage destinations; retention must be configured on the destination workspace or storage account lifecycle policies.

Key Concept

Azure Monitor Diagnostic Settings routing and log categories for Azure Bastion, including destination-based retention policies.
Estimated Time:1m 30s
Rate this question

Topics

Azure Monitor Metrics and Diagnostic Settings

More questions from this topic