Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

You are designing a monitoring and log routing solution for an enterprise Azure environment. Match each log ingestion or routing requirement to its most appropriate Azure Monitor destination or configuration component.

  • Diagnostic logs of an Azure Key Vault that must be ingested into a non-Azure SIEM system in near real-time.Azure Event Hubs
  • Platform metrics and logs of virtual machines across multiple subscriptions that need to be analyzed using Kusto Query Language (KQL).Centralized Log Analytics Workspace
  • Azure subscription Activity Logs that must be retained for 5 years to meet regulatory compliance at the lowest possible cost.Azure Storage Account
  • Custom application logs from on-premises servers that need to be ingested into Azure Monitor without deploying local agents on the virtual machines.Data Collection Endpoint (DCE) and Logs Ingestion API

Answer

Key Vault logs to SIEM match with Azure Event Hubs; VM platform metrics and logs match with Centralized Log Analytics Workspace; Subscription Activity Logs for 5-year retention match with Azure Storage Account; Custom agentless on-premises logs match with Data Collection Endpoint and Logs Ingestion API.
The correct pairings align each workload's technical and financial constraints to the exact Azure Monitor feature designed for that purpose: Event Hubs for real-time SIEM integration, Log Analytics for active KQL query support, Storage Accounts for low-cost archive, and the Logs Ingestion API with a Data Collection Endpoint for custom agentless data submission.

Step-by-Step Solution

1
Evaluate the real-time third-party SIEM log delivery requirement.
Identify Azure Event Hubs as the message queueing mechanism that interfaces with external security tools.
SIEM systems require a low-latency push stream, which Event Hubs provides.
2
Determine the query requirements for VM logs across multiple subscriptions.
Select a centralized Log Analytics Workspace to store and analyze logs.
KQL queries and dashboards require logs to be stored in a queryable analytics engine.
3
Assess the long-term retention requirement under strict cost-minimization constraints.
Route Activity Logs to an Azure Storage Account.
Storage accounts offer the cheapest tier of storage for compliance logs that do not need to be queried regularly.
4
Analyze the custom, agentless ingestion requirement for on-premises systems.
Utilize a Data Collection Endpoint (DCE) and the Logs Ingestion API.
This setup allows secure log ingestion over HTTPS directly from code or custom integrations without a VM agent.

Key Concept

Selecting optimal Azure Monitor routing destinations and ingestion mechanisms based on cost, latency, query, and integration constraints.
Rate this question

Topics

Monitoring and Log Routing Solutions