All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

You plan to deploy a Standard Load Balancer in an Azure subscription. You create a public IP address to be used as the frontend for the load balancer. However, when you attempt to associate the public IP address with the Standard Load Balancer, the public IP address is not available for selection in the Azure portal. What is the most likely cause of this issue?

The public IP address was created using the Basic SKU.

The public IP address was created in a different resource group than the load balancer.

The public IP address is configured with dynamic IP address allocation.

The public IP address has not been associated with a virtual network subnet.

Show answer & explanation

Answer: The public IP address was created using the Basic SKU.

Answer

The public IP address was created using the Basic SKU.

An Azure Standard Load Balancer requires a Standard SKU Public IP address. Basic SKU Public IP addresses are incompatible and will not appear in the selection menu when configuring a Standard Load Balancer frontend.

Step-by-Step Solution

Identify the SKU requirements for the Azure Load Balancer being deployed.

The scenario specifies a Standard Load Balancer.

Standard Load Balancers have strict SKU matching requirements for associated public IP addresses.

Evaluate the compatibility rules between Load Balancer SKUs and Public IP SKUs.

Standard Load Balancers require Standard SKU Public IPs, while Basic Load Balancers require Basic SKU Public IPs.

Mixing Basic and Standard SKUs between these resources is not supported in Azure.

Determine the cause of the public IP not being selectable in the portal.

The public IP must have been created as a Basic SKU IP, making it incompatible and thus hidden from the selection menu.

Azure portal filters out incompatible SKUs during configuration to prevent deployment errors.

Key Concept

SKU compatibility between Azure Load Balancer and Public IP addresses

Question 1242Question →

Luminary Financials has an Azure subscription named sub-luminary-prod. The subscription contains the following resources:

* An Azure Storage account named saluminarydata configured to use a user-assigned managed identity named uami-storage-enc for encryption.
* An Azure Key Vault named kv-luminary-keys that has soft-delete and purge protection enabled, and is configured to use Azure role-based access control (Azure RBAC) for authorization.

You need to configure saluminarydata to encrypt its data using a customer-managed key stored in kv-luminary-keys by using the uami-storage-enc identity.

Which role assignment is required on kv-luminary-keys to successfully configure the storage encryption?

Assign the Key Vault Contributor role to the uami-storage-enc identity

Assign the Key Vault Crypto Service User role to the uami-storage-enc identity

Assign the Key Vault Crypto Service User role to the saluminarydata system-assigned identity

Assign the Key Vault Reader role to the uami-storage-enc identity

Show answer & explanation

Answer: Assign the Key Vault Crypto Service User role to the uami-storage-enc identity

Answer

Assign the Key Vault Crypto Service User role to the uami-storage-enc identity

To configure storage account encryption with customer-managed keys (CMK) using a user-assigned managed identity when the Key Vault uses Azure RBAC, the identity must be granted data-plane permissions. Assigning the Key Vault Crypto Service User role to the user-assigned managed identity is the correct approach because it provides the required permissions to perform key wrap and unwrap operations.

Step-by-Step Solution

Identify the managed identity configured on the storage account for encryption purposes.

The identity is the user-assigned managed identity named uami-storage-enc.

Permissions must be granted to the specific identity that the storage account uses to authenticate against the Key Vault.

Determine the authorization model of the Key Vault.

The Key Vault kv-luminary-keys uses Azure role-based access control (Azure RBAC) for authorization.

Knowing the authorization model determines whether you need to configure Key Vault Access Policies or assign Azure RBAC roles.

Determine the minimum role that grants key wrap and unwrap operations.

The Key Vault Crypto Service User role provides the necessary data-plane permissions to perform wrap and unwrap operations on keys.

Following the principle of least privilege, the Key Vault Crypto Service User role is sufficient for storage account encryption, whereas Key Vault Contributor is a control-plane role and does not grant key access.

Key Concept

To configure customer-managed keys (CMK) for Azure Storage encryption when the target Key Vault uses Azure RBAC, the identity used by the storage account must be assigned the Key Vault Crypto Service User role on the Key Vault. This role grants data-plane permissions (specifically wrap and unwrap key actions) required for encryption.

Question 1243Question →

You have an Azure subscription that contains two virtual machines named VM1 and VM2. The network interface of each virtual machine is associated with a Basic SKU public IP address. You deploy a Standard SKU public load balancer named LB1. You need to add VM1 and VM2 to the backend pool of LB1. Which action should you perform first?

Disassociate or upgrade the Basic SKU public IP addresses from the network interfaces of VM1 and VM2.

Configure the frontend IP configuration of LB1 to use a new Basic SKU public IP address.

Associate a Network Security Group (NSG) with the subnets of VM1 and VM2.

Create a new Basic SKU load balancer and configure LB1 to chain traffic to it.

Show answer & explanation

Answer: Disassociate or upgrade the Basic SKU public IP addresses from the network interfaces of VM1 and VM2.

Answer

Disassociate or upgrade the Basic SKU public IP addresses from the network interfaces of VM1 and VM2.

The correct answer is correct because a Standard SKU load balancer requires that any public IP addresses associated with virtual machines in its backend pool must also be of the Standard SKU. If the virtual machines have Basic SKU public IPs associated with their network interfaces, those IP addresses must be removed (disassociated) or upgraded to Standard SKU before the virtual machines can be successfully added to the backend pool of the Standard Load Balancer.

Step-by-Step Solution

Identify the SKU mismatch between the backend virtual machines' instance-level public IP addresses and the load balancer.

VM1 and VM2 have Basic SKU public IPs, while LB1 is a Standard SKU load balancer.

Azure enforces that resources in the backend pool of a Standard load balancer must use Standard SKU public IP resources or have no public IP at all.

Select the appropriate resolution path to achieve SKU compatibility.

The Basic SKU public IPs must either be disassociated from the network interfaces or upgraded to the Standard SKU.

This removes the incompatible Basic SKU reference, allowing the virtual machines to be successfully registered to the backend pool of the Standard load balancer.

Key Concept

Azure Standard Load Balancer backend pool members must have matching Standard SKU public IP configurations or no public IP configurations on their network interfaces.

Estimated Time:1m 30s

Question 1244Question →

An administrator needs to write a Kusto Query Language (KQL) query in a Log Analytics workspace. The query must retrieve all records from the AzureActivity table where the Level column is equal to "Error" and the event occurred within the last 24 hours.

Which two of the following KQL queries will retrieve the required records? (Select two.)

Select all that apply

AzureActivity
| where Level == "Error" and TimeGenerated > ago(24h)

AzureActivity
| where TimeGenerated > ago(1d)
| where Level == "Error"

AzureActivity
| filter Level == "Error" and TimeGenerated > ago(24h)

AzureActivity
| where Level = "Error" and TimeGenerated > ago(24h)

Show answer & explanation

Answer: AzureActivity
| where Level == "Error" and TimeGenerated > ago(24h); AzureActivity
| where TimeGenerated > ago(1d)
| where Level == "Error"

Answer

The correct queries are the ones that use the where operator with the double equals comparison, either as a single compound expression or as sequential where clauses.

The correct KQL queries use the where operator to filter the records and the double equals (==) operator to evaluate equality on the Level column. They also correctly utilize the ago function to filter the TimeGenerated column, using either 24h or 1d as the duration. Consecutive where clauses in KQL act as a logical AND.

Step-by-Step Solution

Identify the correct operator for filtering rows in KQL.

The where operator is used for filtering. The filter operator is invalid.

KQL uses the where operator to filter rows based on conditions.

Determine the correct equality comparison operator in KQL.

The double equals (==) operator must be used.

A single equals (=) operator is reserved for assignment in KQL, such as when creating new columns.

Evaluate the time filter condition for the last 24 hours.

Both ago(24h) and ago(1d) are valid expressions representing the past 24 hours.

The ago function calculates the offset from the current UTC time.

Key Concept

Filtering and basic syntax rules in Kusto Query Language (KQL)

Question 1245Question →

An organization's Azure environment is structured with the following hierarchy:
- Management Group: `MG-Finance`
- Subscription: `Sub-Auditing`
- Resource Group: `RG-Compliance`
- Storage Account: `saaudits` (located in `RG-Compliance`)

A user named AuditAdmin1 must be able to read blob logs stored in a container named `logs-2026` inside the storage account `saaudits`. AuditAdmin1 must also be able to view the configuration settings of all resources within the `RG-Compliance` resource group, but must not be able to modify any resources or configuration settings. Which of the following configurations meets the requirements while applying the principle of least privilege?

Assign the Reader role for the RG-Compliance resource group, and assign the Storage Blob Data Reader role for the saaudits storage account.

Assign the Reader role for the MG-Finance management group, and assign the Storage Blob Data Reader role for the Sub-Auditing subscription.

Assign the Reader role for the RG-Compliance resource group, and assign the Reader role for the saaudits storage account.

Assign the Security Reader role in Microsoft Entra ID, and assign the Reader role for the saaudits storage account.

Show answer & explanation

Answer: Assign the Reader role for the RG-Compliance resource group, and assign the Storage Blob Data Reader role for the saaudits storage account.

Answer

Assign the Reader role for the RG-Compliance resource group, and assign the Storage Blob Data Reader role for the saaudits storage account.

The correct configuration applies the Reader role at the resource group scope to satisfy the control-plane view requirement, and the Storage Blob Data Reader role at the storage account scope to satisfy the data-plane read requirement. This ensures the user has exactly the permissions needed without any write/modify permissions or access to adjacent resources.

Step-by-Step Solution

Identify the control-plane requirement.

The user needs to view resource configurations in the RG-Compliance resource group without modifying them. This maps to the Reader role at the RG-Compliance scope.

Applying the role at the resource group scope ensures least privilege compared to higher scopes like management groups or subscriptions.

Identify the data-plane requirement.

The user needs to read blob logs inside the saaudits storage account. This maps to the Storage Blob Data Reader role at the saaudits scope.

Azure RBAC separates control-plane operations (viewing resources) from data-plane operations (reading blob data). The standard Reader role does not grant blob data access, so a specialized data-plane role must be assigned.

Combine assignments to form the least privilege configuration.

The combination of the Reader role on the resource group and the Storage Blob Data Reader role on the storage account satisfies all requirements without granting excess permissions.

This target assignment ensures the user cannot modify resources and has no access to other resource groups or subscriptions.

Key Concept

Applying Azure RBAC roles at the appropriate scope using the principle of least privilege, distinguishing between control-plane and data-plane access, and avoiding Entra ID directory roles for Azure resources.

Question 1246Question →

An administrator is setting up `vnet-retail-prod` within an Azure subscription using the address space $10.40.0.0/16$ . The design requires two subnets: one named `snet-app` to accommodate at least $12$ virtual machines, and one named `AzureBastionSubnet` for an Azure Bastion deployment. Which CIDR block prefix sizes represent the minimum requirements for both subnets?

A prefix of

/28

for `snet-app` and

/27

for `AzureBastionSubnet`

A prefix of

/27

for `snet-app` and

/27

for `AzureBastionSubnet`

A prefix of

/27

for `snet-app` and

/26

for `AzureBastionSubnet`

A prefix of

/28

for `snet-app` and

/26

for `AzureBastionSubnet`

Show answer & explanation

Answer: A prefix of $/27$ for `snet-app` and $/26$ for `AzureBastionSubnet`

Answer

A prefix of

/27

for `snet-app` and

/26

for `AzureBastionSubnet`

The correct configuration uses a prefix of

/27

for the application subnet and

/26

for the Azure Bastion subnet. The application subnet needs to support at least

12

virtual machines. Since Azure reserves

5

IP addresses in every subnet (the first four and the last one), the subnet must have a total size of at least

12 + 5 = 17

IP addresses. A

/28

prefix provides only

16

total IP addresses (leaving

11

usable), which is not enough. A

/27

prefix provides

32

total IP addresses (leaving

27

usable), making it the smallest valid prefix. Additionally, Azure Bastion requires a dedicated subnet named `AzureBastionSubnet` with a prefix of

/26

or larger.

Step-by-Step Solution

Calculate the minimum IP address space required for the application subnet `snet-app` by factoring in the VM requirements and Azure's default IP reservations.

To host

12

virtual machines, we must add the

5

IP addresses that Azure reserves in every subnet (the first four and the last one). This results in a requirement of at least

12 + 5 = 17

total IP addresses.

This determines the minimum total size of the CIDR block for the application subnet.

Determine the smallest CIDR block prefix size that can accommodate the required total IP addresses for the application subnet.

/28

subnet provides

2^{32-28} = 16

total IP addresses (

11

usable), which is insufficient. A

/27

subnet provides

2^{32-27} = 32

total IP addresses (

27

usable), which satisfies the requirement of

17

total IPs.

This identifies

/27

as the minimum size for the application subnet.

Identify the minimum subnet prefix size constraint for Azure Bastion.

Azure Bastion must be deployed in a dedicated subnet named exactly `AzureBastionSubnet`, and it requires a minimum prefix size of

/26

(

64

IP addresses).

This applies the platform-specific constraint for Azure Bastion deployments.

Key Concept

Azure Virtual Network subnet sizing rules, specifically the 5 reserved IP addresses per subnet and the minimum /26 prefix size constraint for Azure Bastion subnets.

Question 1247Question →

An organization's Azure environment has the following resource hierarchy:
- Management Group: `MG-Corporate`
- Subscription: `Sub-Dev`
- Resource Group: `RG-Shared`
- Resource Group: `RG-Secret`

A group of developers is currently assigned the Reader role at the `Sub-Dev` subscription scope. You must ensure that the developers can view resources in `RG-Shared`, but they must not be able to view any resources in `RG-Secret`.

Which configuration should you implement to meet this requirement while adhering to the principle of least privilege?

Remove the Reader role assignment from the subscription level, and assign the Reader role to the developer group at the RG-Shared resource group scope.

Keep the Reader role assignment at the subscription level, and assign a custom Azure RBAC role with a Deny action to the developer group at the RG-Secret resource group scope.

Keep the Reader role assignment at the subscription level, and assign the Reader role to the developer group at the RG-Shared resource group scope while omitting the assignment at the RG-Secret scope.

Remove the Reader role assignment from the subscription level, and assign the Global Reader directory role in Microsoft Entra ID to the developer group.

Show answer & explanation

Answer: Remove the Reader role assignment from the subscription level, and assign the Reader role to the developer group at the RG-Shared resource group scope.

Answer

Remove the Reader role assignment from the subscription level, and assign the Reader role to the developer group at the RG-Shared resource group scope.

Removing the subscription-level Reader assignment prevents developers from inheriting read access to RG-Secret. Assigning the Reader role directly at the RG-Shared scope restricts their access to only the necessary resource group, fulfilling the security requirement without over-provisioning.

Step-by-Step Solution

Analyze the impact of the current subscription-level assignment.

The Reader assignment at the subscription level is inherited by all descendant scopes, meaning the developer group currently has read access to both RG-Shared and RG-Secret.

Azure RBAC roles are additive and inherit down the resource hierarchy.

Evaluate restrictiveness options in standard Azure RBAC.

Standard Azure RBAC does not support manual Deny assignments to block inherited permissions.

Since inherited permissions cannot be blocked at a lower scope, the broad parent assignment must be removed to secure RG-Secret.

Re-assign permissions at the target resource group scope.

Remove the role from the subscription and assign the Reader role directly to the developer group at the RG-Shared scope.

This configuration provides the required access to RG-Shared while preventing any access to RG-Secret, adhering to the principle of least privilege.

Key Concept

Azure RBAC inheritance and scope hierarchy

Question 1248Question →

You are configuring a script on an Azure virtual machine (VM) to automate the daily upload of log files to a blob container in an Azure storage account named stlogs. The VM is configured with a system-assigned managed identity that has been granted the Storage Blob Data Contributor role on the storage account. The script must run without any interactive prompts. Which command must be executed in the script to authenticate AzCopy before running the copy command?

azcopy login --identity

azcopy login

azcopy login --service-principal --tenant-id <tenant-id> --username <username>

Append a Shared Access Signature (SAS) token to the destination URL that is configured with a one-year expiration window.

Show answer & explanation

Answer: azcopy login --identity

Answer

The command 'azcopy login --identity' must be executed.

The command 'azcopy login --identity' instructs AzCopy to authenticate using the virtual machine's system-assigned managed identity. This enables secure, non-interactive authentication suitable for automated scripts without exposing or managing credentials.

Step-by-Step Solution

Identify the authentication requirements for the non-interactive script running on the Azure VM.

The script must authenticate without user prompt, utilizing the pre-configured system-assigned managed identity.

Managed identities allow Azure resources to authenticate to cloud services without embedding credentials in code.

Select the correct AzCopy login parameter that targets the managed identity endpoint.

The '--identity' parameter specifies that AzCopy should obtain an Access Token from the local managed identity endpoint.

Without this parameter, AzCopy defaults to interactive user login or requires service principal credentials.

Key Concept

AzCopy authentication using managed identities for automated, non-interactive workflows.

Question 1249Question →

A company plans to migrate an inventory management application to Azure App Service. The application hosting environment must meet the following requirements:
- Support a custom domain with an IP-based SSL binding.
- Support scaling out to a maximum of 8 instances to handle peak workload demands.
- Support automated backups scheduled twice daily.

Which App Service plan pricing tier is the most cost-effective option that meets these requirements?

P1v3

Show answer & explanation

Answer: S1

Answer

The Standard (S1) tier is the most cost-effective pricing tier that meets all the requirements.

The Standard (S1) tier is correct because it supports custom domains, SSL bindings, scaling up to 10 instances (meeting the 8-instance requirement), and up to 10 automated backups daily (meeting the twice-daily requirement), and it is cheaper than the Premium v3 (P1v3) tier.

Step-by-Step Solution

Analyze the scaling requirement.

The application requires scaling out to 8 instances. The Free (F1) tier does not support scaling, and the Basic (B1) tier is limited to 3 instances. The Standard (S1) tier supports up to 10 instances, and the Premium v3 (P1v3) tier supports up to 30 instances.

To eliminate tiers that do not support the required scale-out capacity.

Analyze the backup requirement.

The application requires automated backups twice daily. The Free and Basic tiers do not support automated backups, while the Standard tier supports up to 10 backups daily, and Premium supports up to 50 backups daily.

To ensure the selected tier supports automated backup scheduling.

Determine the most cost-effective tier from the remaining compliant options.

Both Standard (S1) and Premium v3 (P1v3) meet all requirements (custom domain, IP-based SSL, 8 instances scale-out, and twice-daily backups). Standard (S1) is more cost-effective than Premium v3 (P1v3).

To identify the optimal, most cost-effective solution.

Key Concept

Azure App Service plan tiers define the available features, scaling limits, and backup capabilities. Selecting the optimal tier requires matching application requirements like custom domains, scaling limits, and backup schedules to the most cost-effective tier.

Question 1250Question →

An Azure subscription contains the following resources:
- A virtual machine named `vm-sales-portal` located in the `Southeast Asia` region
- A virtual machine named `vm-inventory-db` located in the `East Asia` region
- A Recovery Services Vault named `rsv-sales-sea` located in the `Southeast Asia` region

To which virtual machines can you apply a backup policy from `rsv-sales-sea`?

Only `vm-sales-portal`

Only `vm-inventory-db`

Both `vm-sales-portal` and `vm-inventory-db`

Neither `vm-sales-portal` nor `vm-inventory-db`

Show answer & explanation

Answer: Only `vm-sales-portal`

Answer

Only the virtual machine named `vm-sales-portal` can be backed up using the Recovery Services Vault named `rsv-sales-sea`.

To configure backup for an Azure virtual machine, the Recovery Services Vault and the target virtual machine must reside in the same Azure region. Since the virtual machine named `vm-sales-portal` and the vault named `rsv-sales-sea` are both in the Southeast Asia region, backup can be configured for this virtual machine only.

Step-by-Step Solution

Identify the region of each resource.

The vault `rsv-sales-sea` and the virtual machine `vm-sales-portal` are in the Southeast Asia region, while `vm-inventory-db` is in the East Asia region.

Azure Backup regional constraints dictate that virtual machines and the Recovery Services Vault must reside in the same region.

Determine eligibility based on the regional boundary.

Only the virtual machine in Southeast Asia (`vm-sales-portal`) can be backed up to the vault in Southeast Asia.

Cross-region backups of virtual machines to a Recovery Services Vault are not supported.

Key Concept

Recovery Services Vault regional constraint for virtual machine backup

Question 1251Question →

You have an Azure subscription that contains a Recovery Services vault named `rsv-finance-backup` and a Premium storage account named `sa-finance-prod` in the West US 2 region. The storage account hosts two file shares: `share-smb-data` (an SMB file share) and `share-nfs-repos` (an NFS file share).

The firewall of `sa-finance-prod` is configured to allow access only from selected virtual networks and IP addresses.

You need to enable Azure Backup for the file shares in `sa-finance-prod` using `rsv-finance-backup`. The configuration must adhere to the principle of least privilege.

An administrator named Admin1 is assigned the Backup Operator role for `rsv-finance-backup`.

Which configuration steps should you perform to ensure Admin1 can successfully configure the backup?

Configure the firewall of `sa-finance-prod` to allow trusted Microsoft services to access the storage account, assign Admin1 the Contributor role on `sa-finance-prod`, and configure backup for only `share-smb-data`.

Configure the firewall of `sa-finance-prod` to allow trusted Microsoft services to access the storage account, assign Admin1 the Storage Blob Data Contributor role on `sa-finance-prod`, and configure backup for both `share-smb-data` and `share-nfs-repos`.

Add the outbound IP addresses of `rsv-finance-backup` to the firewall of `sa-finance-prod`, assign Admin1 the Owner role on `sa-finance-prod`, and configure backup for both `share-smb-data` and `share-nfs-repos`.

Configure the firewall of `sa-finance-prod` to allow trusted Microsoft services to access the storage account, assign Admin1 the Backup Operator role on `sa-finance-prod`, and configure backup for only `share-smb-data`.

Show answer & explanation

Answer: Configure the firewall of `sa-finance-prod` to allow trusted Microsoft services to access the storage account, assign Admin1 the Contributor role on `sa-finance-prod`, and configure backup for only `share-smb-data`.

Answer

Configure the firewall of the storage account to allow trusted Microsoft services, assign the administrator the Contributor role on the storage account, and configure backup for only the SMB file share.

To configure backups for an Azure file share when the storage account firewall is enabled, the administrator must enable the 'Allow trusted Microsoft services to access this storage account' bypass. In addition, the administrator needs control-plane write access (such as the Contributor role) on the storage account to perform the registration. Furthermore, Azure Backup only supports the SMB protocol, meaning only the SMB file share can be backed up.

Step-by-Step Solution

Evaluate the file share protocol support for Azure Backup.

Only the SMB file share can be backed up using the Recovery Services Vault. The NFS file share is unsupported.

Azure Backup for Azure Files currently only supports the SMB protocol; NFS file shares cannot be registered or backed up.

Configure the storage account firewall settings to allow vault access.

Enable the 'Allow trusted Microsoft services to access this storage account' bypass option on the storage account firewall.

Since the storage account is restricted to selected networks, the Recovery Services Vault needs this exception enabled to access the storage account.

Assign the necessary Azure RBAC role to the administrator configuring the backup.

Assign the administrator the Contributor role (or Owner) on the storage account.

Although the administrator has the Backup Operator role on the vault, registering a storage account with the vault requires control-plane write permissions on the storage account itself.

Key Concept

Azure Files Backup prerequisites, including network firewall exceptions, RBAC permissions for storage registration, and protocol limitations.

Question 1252Question →

You have an Azure SQL Database named `sqldb-sales`. You need to configure diagnostic logging to satisfy the following requirements:
- Send the SQL database audit logs (`SQLSecurityAuditEvents`) to a Log Analytics workspace named `law-security` for querying.
- Send the database performance metrics (`Basic`) to an Azure storage account named `stvalaudit` for long-term archiving.
- Minimize data ingestion costs by ensuring log data is not sent to the storage account and metric data is not sent to the Log Analytics workspace.

Which configuration should you implement?

Create a single diagnostic setting that routes both `SQLSecurityAuditEvents` and `Basic` metrics to both the Log Analytics workspace and the storage account.

Create a single diagnostic setting that routes `SQLSecurityAuditEvents` to the Log Analytics workspace, and configure the database backup settings to export performance metrics to the storage account.

Create two separate diagnostic settings: one that routes `SQLSecurityAuditEvents` to the Log Analytics workspace, and another that routes `Basic` metrics to the storage account.

Create a single diagnostic setting routing all diagnostic data to the Log Analytics workspace, and configure an Azure Storage lifecycle management policy to copy metrics from the workspace to the storage account.

Show answer & explanation

Answer: Create two separate diagnostic settings: one that routes `SQLSecurityAuditEvents` to the Log Analytics workspace, and another that routes `Basic` metrics to the storage account.

Answer

Create two separate diagnostic settings: one that routes the SQL database audit logs to the Log Analytics workspace, and another that routes the database performance metrics to the storage account.

A single Azure diagnostic setting routes all selected log categories and metrics to all configured destinations. To route audit logs (`SQLSecurityAuditEvents`) exclusively to the Log Analytics workspace and performance metrics (`Basic`) exclusively to the storage account without sending unwanted data to either destination, you must create two separate diagnostic settings. Azure resources support configuring up to 5 diagnostic settings.

Step-by-Step Solution

Analyze how diagnostic settings handle routing when multiple categories and destinations are selected within the same setting.

Recognize that a single diagnostic setting operates as a broadcast mechanism, sending all selected logs and metrics to all specified destinations.

This dictates that selecting both the Log Analytics workspace and the storage account in one setting would result in all logs and metrics being sent to both locations, incurring unnecessary costs.

Determine if Azure resources support multiple diagnostic settings to split routing.

Confirm that Azure resources support up to 5 diagnostic settings, allowing separate settings to be applied to the same resource.

This capability allows configuring distinct routing paths for different categories of logs and metrics.

Design the configuration with separate settings to meet the isolation and cost requirements.

Create one setting for `SQLSecurityAuditEvents` targeting the workspace, and a second setting for `Basic` metrics targeting the storage account.

This satisfies the scenario requirements while preventing cross-routing and minimizing data ingestion costs.

Key Concept

Routing different diagnostic logs and metrics to different destinations using multiple diagnostic settings.

PreviousPage 63 / 63

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes