Examkin

Question

Difficulty: MediumAzure Monitor Metrics and Diagnostic Settings

You need to configure diagnostic settings for several Azure resources. Match each administrative monitoring requirement on the left to the most appropriate Azure Monitor diagnostic setting destination on the right. Each destination may be used once, more than once, or not at all.

  • Retain resource diagnostic logs for 365 days for regulatory compliance at the lowest possible cost.Azure Storage account
  • Stream security and access logs with minimal latency to an external, third-party SIEM system.Azure Event Hub
  • Perform complex correlation queries across multiple resources using Kusto Query Language (KQL).Log Analytics workspace
  • Send log data to a supported SaaS partner monitoring tool using a native Azure service integration.Partner integration

Answer

Retain logs for 365 days at lowest cost matches Azure Storage account; Stream logs with minimal latency to external SIEM matches Azure Event Hub; Perform complex correlation queries using KQL matches Log Analytics workspace; Send log data to SaaS partner matches Partner integration.
Each monitoring requirement maps to a specific destination type supported by Azure Monitor diagnostic settings. Archive/long-term low-cost storage maps to Azure Storage accounts. Low-latency external streaming maps to Azure Event Hubs. Querying and analysis using KQL maps to Log Analytics workspaces. Sending logs directly to supported partner tools maps to Partner integrations.

Step-by-Step Solution

1
Identify the destination required for low-cost, long-term retention.
Azure Storage account is identified, as it offers the cheapest cold storage options for archiving logs.
Regulatory compliance requiring 365-day retention without active querying is best served by archival storage.
2
Identify the destination for real-time streaming to external platforms.
Azure Event Hub is identified, as it acts as an event ingestor and streamer.
Integrating with an external SIEM system with minimal latency requires a streaming service like Event Hubs.
3
Identify the destination for advanced querying using KQL.
Log Analytics workspace is identified, as it contains the database engine for log searches.
To write Kusto Query Language (KQL) queries across resource logs, the logs must be sent to a Log Analytics workspace.
4
Identify the destination for third-party SaaS integrations.
Partner integration is identified.
Direct integrations with platforms like Datadog or Dynatrace are configured under the Partner integration option.

Key Concept

Azure Monitor diagnostic settings destination routing and use cases
Rate this question

Topics

Azure Monitor Metrics and Diagnostic Settings

More questions from this topic