Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

An enterprise is designing a diagnostic log routing solution for a workload consisting of Azure Key Vault instances and Azure SQL Database instances. The solution must satisfy the following constraints:
- Audit logs for all key operations and access attempts in Azure Key Vault must be routed to an external, third-party security information and event management (SIEM) system with sub-minute latency.
- Azure SQL Database transaction logs must be stored cost-effectively in a Write Once, Read Many (WORM) format for 5 years within the same region.
- Access control configuration must adhere to the principle of least privilege, preventing the assignment of permissions directly to individual administrator user accounts.

Which two destination resources and configurations should you include in the diagnostic settings design? (Select two.)

  1. An Azure Event Hubs namespace to stream the Key Vault diagnostic logs to the external SIEM.Answer
  2. An Azure Storage account configured with a time-based retention policy for immutable storage (WORM) to store the SQL Database transaction logs.Answer
  3. C
    A single centralized Log Analytics workspace to store all logs, with monitoring access permissions assigned directly to individual administrator user accounts.
  4. D
    A single centralized Log Analytics workspace located in a different region to aggregate all diagnostic logs to minimize administrative workspace overhead.
  5. E
    An Azure Policy configured with a Deny effect to automatically deploy diagnostic settings for all database resources.

Answer

An Azure Event Hubs namespace to stream the Key Vault diagnostic logs to the external SIEM, and an Azure Storage account configured with a time-based retention policy for immutable storage (WORM) to store the SQL Database transaction logs.
To stream Key Vault diagnostic logs to a third-party SIEM with sub-minute latency, routing logs to an Azure Event Hubs namespace is the correct approach. For cost-effective archival of SQL Database transaction logs under strict WORM compliance for 5 years, configuring an Azure Storage account with a time-based retention policy for immutable storage meets both cost and compliance requirements.

Step-by-Step Solution

1
Determine the optimal routing destination for Key Vault logs that must reach an external SIEM within a sub-minute window.
Identify that Azure Event Hubs is the designed mechanism for streaming Azure diagnostic logs directly to external systems like third-party SIEMs.
Log Analytics and Storage accounts do not support the real-time, low-latency streaming pipeline required for external SIEM integration without intermediate components.
2
Select a cost-effective storage target that complies with WORM regulatory requirements for a 5-year retention period.
Choose Azure Storage with time-based immutable policies enabled on the destination containers.
Azure Storage is significantly more cost-effective than Log Analytics for long-term cold data retention, and natively supports immutable WORM configuration.
3
Ensure that administrative assignment and automatic deployment comply with operational best practices.
Avoid direct RBAC assignments to individual user accounts, choosing group assignments instead, and ensure diagnostic configurations are deployed dynamically using DeployIfNotExists policies.
Direct user assignments violate security scale requirements, and Deny policies cannot perform automated deployments.

Key Concept

Designing diagnostic log routing architectures in Azure Monitor to meet compliance, latency, cost, and administrative separation requirements.
Rate this question

Topics

Monitoring and Log Routing Solutions