Examkin

Question

Difficulty: MediumImplement Azure Monitor Alerts and Action Groups

An Azure App Service web app logs database connection exceptions to an Application Insights instance. You need to configure an Azure Monitor Log Search alert rule that triggers when database connection exceptions occur more than 10 times within a 5-minute window. When triggered, the alert must run an Azure Function that retrieves a database credential from Azure Key Vault and restarts the connection pool. Which of the following actions should you perform? (Select two)

  1. Create a Log Search alert rule with a KQL query that filters for database connection exceptions, and configure the alert condition's Aggregation Granularity (Period) to 5 minutes.Answer
  2. Create an Azure Monitor Action Group with an Azure Function action type that targets the remediation function, and configure the Function App with a managed identity that has a Key Vault access policy granting GET secrets permission.Answer
  3. C
    Configure the Azure Function to retrieve secrets using the Action Group's system-assigned managed identity, assuming the Action Group's execution context implicitly delegates its permissions to the function.
  4. D
    Configure the Azure Function code to initialize the Application Insights telemetry client without a connection string, expecting the Action Group's trigger payload to automatically supply the telemetry settings at runtime.

Answer

To implement this solution, you must create a Log Search alert rule with a KQL query filtering for database connection exceptions, configure the alert condition's Aggregation Granularity (Period) to 5 minutes, create an Azure Monitor Action Group with an Azure Function action targeting the remediation function, and configure the Function App's managed identity with a Key Vault access policy granting GET secrets permission.
The correct actions involve configuring a Log Search alert rule with the KQL query and the appropriate 5-minute period window, and setting up an Action Group that uses the Azure Function action type while ensuring the function itself has its own managed identity authorized to fetch secrets from the Key Vault.

Step-by-Step Solution

1
Configure the KQL query in the Log Search alert rule to filter database connection exceptions and set the Aggregation Granularity (Period) to 5 minutes.
The alert rule correctly evaluates telemetry data over the specified 5-minute window.
Defining the filter and setting the period ensures the rule triggers precisely when the target conditions are met.
2
Create an Action Group and configure it with an Azure Function action that points to the remediation function.
The alert rule triggers the Azure Function when the threshold is exceeded.
Action Groups map alert triggers to downstream automation resources such as Azure Functions.
3
Configure a system-assigned or user-assigned managed identity on the Function App and grant it a Key Vault access policy with GET permissions.
The Azure Function is authorized to retrieve the database credential from Key Vault.
The Azure Function runs under its own identity context, which must be explicitly authorized to access Key Vault secrets.

Key Concept

Integrating Azure Monitor Alert Rules with Action Groups and securing downstream resource access.
Rate this question

Topics

Implement Azure Monitor Alerts and Action Groups

More questions from this topic