Examkin

Question

Difficulty: EasyAzure Monitor Metrics and Diagnostic Settings

You have an Azure Key Vault named KV1. You need to ensure that all secret read and write audit events in KV1 are collected and stored in a Log Analytics workspace named Workspace1. What configuration should you create on KV1?

  1. Configure a diagnostic setting on KV1 that enables the AuditEvent log category and specifies Workspace1 as the destination.Answer
  2. B
    Configure a diagnostic setting on KV1 that enables only the AllMetrics category and specifies Workspace1 as the destination.
  3. C
    Configure the Azure Activity log for the subscription to export events directly to Workspace1.
  4. D
    Assign the Storage Blob Data Reader Role for Workspace1 to KV1.

Answer

Configure a diagnostic setting on KV1 that enables the AuditEvent log category and specifies Workspace1 as the destination.
To collect and store audit data from data-plane transactions inside an Azure resource like Key Vault, you must configure a diagnostic setting on the resource itself. Enabling the AuditEvent log category and choosing Workspace1 as the target Log Analytics workspace satisfies all the requirements.

Step-by-Step Solution

1
Determine the event source type.
Secret read and write events represent data-plane operations inside the Key Vault resource, which fall under Key Vault resource logs (specifically the AuditEvent category).
Identifying the event type determines whether you need to target subscription-level logs (Activity Log) or resource-level logs (Diagnostic Settings).
2
Select the correct Azure Monitor mechanism for resource logs.
Resource diagnostic settings are used to route logs to destinations.
Diagnostic settings must be configured on the individual resource generating the logs to define which logs and metrics are exported.
3
Select the required log category and destination workspace.
The setting must specify the AuditEvent category and route it to the target Log Analytics workspace.
This directly fulfills the requirement of sending the audit logs to the specified workspace.

Key Concept

Azure Monitor Diagnostic Settings allow resource logs and metrics to be collected and routed to destinations like Log Analytics workspaces.
Estimated Time:45s
Rate this question

Topics

Azure Monitor Metrics and Diagnostic Settings

More questions from this topic