Examkin

Question

Difficulty: MediumAzure Monitor Metrics and Diagnostic Settings

An administrator needs to configure diagnostic settings for multiple Azure resources. Match each business monitoring requirement to its correct destination target.

  • Retain diagnostic logs for 3 years at the lowest possible cost for regulatory compliance.Azure Storage account
  • Stream resource log data to an external, non-Azure SIEM system with minimal latency.Azure Event Hubs namespace
  • Perform complex correlation queries across multiple resources using Kusto Query Language (KQL).Log Analytics workspace

Answer

Retain logs for 3 years at the lowest cost matches Azure Storage account; Stream logs to external SIEM matches Azure Event Hubs namespace; Perform complex correlation queries using KQL matches Log Analytics workspace.
The correct mapping pairs long-term low-cost archiving with a Storage account, real-time external SIEM ingestion with Event Hubs, and KQL query capabilities with a Log Analytics workspace.

Step-by-Step Solution

1
Analyze the long-term archiving requirement.
Storing logs for 3 years at the lowest cost is best suited for Azure Storage account because it offers cold/archive tiers designed for long-term retention without active query costs.
Log Analytics and Event Hubs are more expensive for multi-year storage.
2
Analyze the real-time external integration requirement.
Streaming to an external SIEM with minimal latency requires a publish-subscribe message broker, which is provided by routing diagnostic settings to an Azure Event Hubs namespace.
Storage accounts and Log Analytics do not provide direct low-latency push streaming to external platforms.
3
Analyze the query and correlation requirement.
Querying logs across multiple resources using Kusto Query Language (KQL) requires the data to be ingested into a Log Analytics workspace.
Log Analytics is the native Azure Monitor log repository supporting KQL.

Key Concept

Selecting the appropriate destination target (Storage Account, Event Hub, or Log Analytics) within Azure Monitor Diagnostic Settings to satisfy specific retention, integration, and analysis requirements.
Rate this question

Topics

Azure Monitor Metrics and Diagnostic Settings

More questions from this topic