Examkin

Question

Difficulty: MediumAzure Monitor Metrics and Diagnostic Settings

An administrator needs to configure diagnostic settings across several Azure resources to meet specific security and troubleshooting requirements. Match each monitoring requirement to its correct Azure Monitor diagnostic log category.

  • Track secret retrievals, key rotations, and administrative policy changes in a key vault.AuditEvent
  • Troubleshoot IPsec tunnel negotiation and connectivity failures on a Site-to-Site VPN.IKEDiagnosticLog
  • Analyze client request patterns and blocked SQL injection attacks on a Layer 7 load balancer.ApplicationGatewayAccessLog and ApplicationGatewayFirewallLog
  • Log read, write, and delete transactions performed on object storage containers.StorageRead, StorageWrite, and StorageDelete

Answer

The requirement to track key vault secret retrievals matches AuditEvent; troubleshooting VPN tunnel negotiation matches IKEDiagnosticLog; analyzing Application Gateway WAF and access events matches ApplicationGatewayAccessLog and ApplicationGatewayFirewallLog; logging blob storage transactions matches StorageRead, StorageWrite, and StorageDelete.
The correct matches map each resource's telemetry needs to its exact Azure diagnostic log categories: AuditEvent for Azure Key Vault, IKEDiagnosticLog for VPN gateway tunnel negotiations, ApplicationGatewayAccessLog and ApplicationGatewayFirewallLog for Application Gateway web traffic and threat logs, and StorageRead, StorageWrite, and StorageDelete for granular transactional operations on the storage account's blob service.

Step-by-Step Solution

1
Identify the resource types associated with each monitoring requirement in the scenario.
Requirement 1 corresponds to Azure Key Vault; Requirement 2 corresponds to Azure Virtual Network Gateway; Requirement 3 corresponds to Azure Application Gateway; Requirement 4 corresponds to Azure Storage (Blob service).
Mapping the scenarios to the underlying Azure resource is necessary because diagnostic log categories are resource-specific.
2
Identify the specific diagnostic log categories exposed by each resource type.
Key Vault exposes AuditEvent. Virtual Network Gateway exposes IKEDiagnosticLog, GatewayDiagnosticLog, and RouteDiagnosticLog. Application Gateway exposes access and firewall logs. Storage accounts expose operations split by read, write, and delete.
Matching the resource types to their diagnostic setting schemas reveals the correct log category names.
3
Pair each monitoring requirement with the exact log category that captures the target activities.
Key vault auditing pairs with AuditEvent. VPN troubleshooting pairs with IKEDiagnosticLog. Layer 7 firewall/access auditing pairs with ApplicationGatewayAccessLog/ApplicationGatewayFirewallLog. Object storage transactional auditing pairs with StorageRead/StorageWrite/StorageDelete.
This establishes the correct logical configuration required to stream the specified telemetry to a destination.

Key Concept

Azure Monitor diagnostic settings allow administrators to route resource logs and metrics to various destinations. Each Azure resource type exposes specific log categories that must be individually selected based on the monitoring objectives.
Estimated Time:1m 30s
Rate this question

Topics

Azure Monitor Metrics and Diagnostic Settings

More questions from this topic