Examkin

Question

Difficulty: EasyAzure Monitor Metrics and Diagnostic Settings

You are configuring diagnostic settings for a set of Azure virtual machines and Key Vaults. Match each Azure Monitor diagnostic destination on the left to its corresponding primary administrative use case on the right.

  • Log Analytics workspacePerform interactive KQL log analysis and construct dashboard visualizations.
  • Azure Storage accountStore data for long-term compliance retention at the lowest storage cost.
  • Azure Event HubsStream diagnostic data immediately to external SIEM systems or custom analytics pipelines.

Answer

Log Analytics workspace matches with performing interactive KQL log analysis; Azure Storage account matches with storing data for long-term compliance retention; Azure Event Hubs matches with streaming diagnostic data immediately to external SIEM systems.
Log Analytics is used for interactive KQL analysis, Azure Storage accounts are used for cost-effective long-term storage, and Azure Event Hubs are used for streaming data to external systems.

Step-by-Step Solution

1
Identify the primary capabilities of a Log Analytics workspace.
It supports interactive log analysis, alerting, and KQL queries.
This links it to the requirement for running query-based analytics.
2
Evaluate the storage requirements and costs for long-term data retention.
An Azure Storage account is the standard, lowest-cost destination for cold data storage.
This links the storage account destination to long-term archiving.
3
Determine how to ingest Azure diagnostics into external monitoring tools.
Azure Event Hubs acts as an event ingestion service that streams data out of Azure.
This links the Event Hub destination to real-time integration with external SIEM systems.

Key Concept

Azure Monitor diagnostic settings destination routing rules
Rate this question

Topics

Azure Monitor Metrics and Diagnostic Settings

More questions from this topic