Examkin

Question

Difficulty: HardImplement Azure Monitor Alerts and Action Groups

You are developing a distributed application on Azure. The application components send telemetry to an Azure Application Insights instance. You need to configure an Azure Monitor Log Search Alert rule to monitor exception rates. The alert must trigger when the number of exceptions in a 15-minute window is greater than 50. When the alert triggers, it must execute a custom remediation API hosted on an Azure Function App. Which two of the following actions should you perform? (Choose two.)

  1. Create an Action Group containing an Azure Function receiver that is configured to invoke the HTTPS trigger of the remediation API.Answer
  2. Define the Log Search Alert rule condition using a KQL query that filters the exceptions using a time-relative clause, such as `where timestamp > ago(15m)`.Answer
  3. C
    Configure the distributed application components to send telemetry to Application Insights by initializing the SDK using only the instrumentation key in the configuration file, leaving the connection string unconfigured.
  4. D
    Configure the Action Group to authenticate to the remediation webhook by referencing an Azure Key Vault secret using the `@Microsoft.KeyVault` reference syntax, without granting GET permissions on the Key Vault secrets.

Answer

Create an Action Group containing an Azure Function receiver that is configured to invoke the HTTPS trigger of the remediation API, and define the Log Search Alert rule condition using a KQL query that filters the exceptions using a time-relative clause.
To invoke a custom remediation API hosted on an Azure Function App when a Log Search Alert triggers, you must create an Action Group that includes an Azure Function receiver pointing to the function's HTTP trigger. Additionally, the Log Search Alert rule's KQL query must evaluate exceptions over the target time window. Including an explicit time-relative filter in the KQL query, such as filtering for timestamps within the last 15 minutes, ensures the query executes efficiently and limits the scanned data.

Step-by-Step Solution

1
Ensure telemetry is flowing to Application Insights.
Components are configured using the full Connection String.
The instrumentation key alone is deprecated; the connection string is required to ingest telemetry.
2
Formulate the alert KQL query.
The KQL query retrieves exceptions using a time filter such as `where timestamp > ago(15m)`.
An explicit time range filter optimizes the query execution and prevents scanning unnecessary historical data.
3
Configure the Action Group receiver.
An Azure Function receiver is added to the Action Group to trigger the custom remediation API.
Azure Function receivers are natively supported in Action Groups for executing custom API logic.

Key Concept

Log Search Alert rules rely on optimized KQL queries and use Action Groups with receivers like Azure Functions to execute automated remediation logic.
Rate this question

Topics

Implement Azure Monitor Alerts and Action Groups

More questions from this topic