Examkin

Question

Difficulty: HardLog Analytics Workspaces and KQL Queries

An administrator is configuring access control and monitoring for an Azure subscription. The subscription contains a Log Analytics workspace named Workspace1 that collects logs from virtual machines and Azure SQL databases.

You need to configure Workspace1 and write a Kusto Query Language (KQL) query to meet the following requirements:
- Ensure that database administrators can view diagnostic logs only for their SQL databases. They must not have access to any other logs stored in Workspace1.
- Retrieve SQL database diagnostic logs from the AzureDiagnostics table where the execution duration of a query is greater than 5 seconds.
- Sort the query results to show the longest-running queries first.

Which three options should you select to meet the requirements?

  1. Configure Workspace1 to use the "Use resource or workspace permissions" access control mode.Answer
  2. Assign the Reader role to the database administrators on the resource groups containing the SQL databases.Answer
  3. Run the KQL query: AzureDiagnostics | where ResourceProvider == "MICROSOFT.SQL" and DurationMs > 5000 | sort by DurationMs descAnswer
  4. D
    Configure Workspace1 to use the "Require workspace permissions" access control mode.
  5. E
    Assign the Reader role to the database administrators on Workspace1.
  6. F
    Run the KQL query: AzureDiagnostics | filter ResourceProvider == "MICROSOFT.SQL" and DurationMs > 5000 | sort by DurationMs desc

Answer

To meet the requirements, you must configure Workspace1 to use resource-context permissions, assign the Reader role to database administrators at the resource group level of the SQL databases, and use a KQL query with the 'where' operator and 'sort by' descending.
Enabling 'Use resource or workspace permissions' combined with assigning Reader permissions at the resource level allows resource-context access, which scopes log visibility to only the SQL databases. The correct KQL query uses the 'where' operator to filter records and 'sort by' with the descending modifier to order results by the longest execution times.

Step-by-Step Solution

1
Configure workspace access control.
Setting Workspace1 to 'Use resource or workspace permissions' enables resource-context access, meaning permissions are evaluated at the resource level.
This allows users to view logs for only the resources they have access to, satisfying the privacy requirement.
2
Assign RBAC roles at the resource scope.
Assigning the Reader role to database administrators on the resource groups containing the SQL databases.
This gives them permission to access the SQL database resources and their associated logs, without granting access to the entire Log Analytics workspace.
3
Write and refine the KQL query.
Querying the AzureDiagnostics table filtering by ResourceProvider and DurationMs, then sorting descending.
KQL requires the 'where' operator for filtering and the 'sort by' or 'order by' operator for sorting. The 'filter' operator is invalid syntax.

Key Concept

Log Analytics Workspace access modes (workspace-context vs. resource-context) and basic KQL query syntax.
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic