Examkin

Question

Difficulty: HardImplement Azure Monitor Alerts and Action Groups

You are developing a microservice named `OrderProcessing` that runs on an Azure App Service and sends telemetry to Azure Application Insights. You need to implement an Azure Monitor alert rule that triggers whenever the number of critical exceptions (where the `severityLevel` is 33) exceeds 5050 within any 1515-minute window. The alert evaluation must run every 55 minutes. To minimize query execution latency and data scanning costs, you must configure the query and rule settings efficiently.

Which configuration should you implement?

  1. Configure a Log Search Alert rule with the KQL query `exceptions | where cloud_RoleName == "OrderProcessing" and severityLevel == 3`, set the Measure to Table rows, set the Aggregation granularity (Period) to 1515 minutes, and set the Evaluation frequency to 55 minutes.Answer
  2. B
    Configure a Log Search Alert rule with the KQL query `exceptions | where timestamp > ago(24h) and cloud_RoleName == "OrderProcessing" and severityLevel == 3`, set the Measure to Table rows, set the Aggregation granularity (Period) to 1515 minutes, and set the Evaluation frequency to 55 minutes.
  3. C
    Configure an Action Group with an Autoscale action that references the `Exceptions` metric on the App Service, setting the scale-out threshold to 5050, the Aggregation granularity to 1515 minutes, and the Evaluation frequency to 55 minutes.
  4. D
    Configure a Log Search Alert rule using the KQL query `exceptions | where cloud_RoleName == "OrderProcessing" and severityLevel == 3`, and configure the Action Group's webhook action to retrieve its destination URL from a Key Vault secret using the reference syntax `@Microsoft.KeyVault(SecretUri=...)` in the Action Group settings.

Answer

Configure a Log Search Alert rule with a KQL query that filters the exceptions by cloud role name and severity level, setting the measure to Table rows, the aggregation granularity to 15 minutes, and the evaluation frequency to 5 minutes.
The correct configuration utilizes a Log Search Alert rule with a KQL query that filters for the specific cloud role and severity level, relying on Azure Monitor to automatically apply the time filter on the `timestamp` column based on the configured aggregation granularity (1515 minutes) and evaluation frequency (55 minutes). This prevents redundant query execution and minimizes log scanning costs.

Step-by-Step Solution

1
Analyze the requirement to detect exceptions of a specific severity level over a time window.
Identify that a Log Search Alert rule is required since we need to filter on the `severityLevel` property which is inside log telemetry rather than standard metrics.
Log Search Alerts allow KQL queries on raw Application Insights tables to filter by custom properties and log fields.
2
Determine the correct KQL query design to minimize execution cost.
Write a query without any hardcoded time filter, as Azure Monitor's Scheduled Query Rules automatically append the time filter based on the configured Aggregation Granularity.
Hardcoding a lookback filter like `ago(24h)` scans redundant data on every evaluation, increasing costs and query latency.
3
Evaluate target actions for notifications and integrations.
Configure Action Groups to trigger notifications or external automations, noting that they cannot directly hold autoscale rules or resolve Key Vault references natively.
Action Groups act as the target receiver pipeline, whereas autoscale settings and Key Vault authorization are configured at different layers of Azure.

Key Concept

Azure Monitor Log Search Alerts and Action Groups configuration
Rate this question

Topics

Implement Azure Monitor Alerts and Action Groups

More questions from this topic