Examkin

Question

Difficulty: HardAzure Monitor Metrics and Diagnostic Settings

You have an Azure subscription that contains an Azure Application Gateway named AppGW1. You need to configure diagnostic settings for AppGW1 to meet the following requirements:

- All Web Application Firewall (WAF) logs must be streamed to a third-party Security Information and Event Management (SIEM) system with minimal latency.
- All platform metrics must be archived for a minimum of 365 days at the lowest possible cost.
- WAF logs must not be archived in the storage account, and platform metrics must not be streamed to the SIEM system.

Which configuration should you use to meet these requirements?

  1. Two diagnostic settings: one that routes WAF logs to an Azure Event Hub, and a second that routes platform metrics to an Azure Storage account.Answer
  2. B
    A single diagnostic setting that routes both WAF logs and platform metrics to both an Azure Event Hub and an Azure Storage account.
  3. C
    A single diagnostic setting that routes both WAF logs and platform metrics to an Azure Storage account, and assign the Storage Blob Data Contributor role to the SIEM service principal on the storage account.
  4. D
    Two diagnostic settings: one that routes WAF logs to a Log Analytics workspace, and a second that routes platform metrics to the same Log Analytics workspace with a 365-day retention policy.

Answer

Two diagnostic settings: one that routes WAF logs to an Azure Event Hub, and a second that routes platform metrics to an Azure Storage account.
The correct answer provides the necessary separation of telemetry streams. By creating two diagnostic settings, the administrator can configure the first setting to route only WAF logs to the Azure Event Hub, and the second setting to route only the metrics to the Azure Storage account. This architecture prevents WAF logs from being archived in storage and prevents metrics from being pushed to the SIEM, optimizing ingestion costs and complying with security policies.

Step-by-Step Solution

1
Determine the appropriate Azure target destinations for the logs and metrics based on performance and cost requirements.
Event Hub is selected for low-latency streaming to the external SIEM. Storage Account is selected for low-cost, long-term archiving of metrics.
Log Analytics workspace retention is cost-prohibitive for 365 days compared to Storage Account archiving, and Event Hubs are the standard mechanism for real-time SIEM integration.
2
Analyze how diagnostic settings distribute data when multiple destinations are configured in a single setting.
A single diagnostic setting duplicates all selected log and metric categories to all destinations defined within that setting.
To satisfy the isolation requirement (WAF logs only to SIEM, metrics only to Storage), separate routing definitions must be established.
3
Formulate the final configuration structure to minimize overlap.
Two distinct diagnostic settings are configured on the AppGW1 resource: one routing only the WAF log category to the Event Hub, and the second routing only the platform metrics to the Storage account.
This satisfies the routing and retention requirements while complying with the strict isolation policies.

Key Concept

Azure Monitor Diagnostic Settings Routing Behavior
Rate this question

Topics

Azure Monitor Metrics and Diagnostic Settings

More questions from this topic