Question

Difficulty: EasyMonitoring and Log Routing Solutions

An organization has several virtual machines and web applications running in Azure. The security operations team requires all application transaction logs to be streamed to a third-party Security Information and Event Management (SIEM) system located on-premises in near real-time. Which destination should you configure in the Azure Monitor diagnostic settings to meet this requirement?

A
An Azure Log Analytics workspace
An Azure event hubAnswer
C
An Azure Storage account
D
An Azure Service Bus queue

Answer

An Azure event hub

An Azure event hub is the correct destination because Azure Monitor diagnostic settings natively support routing logs to Event Hubs. This configuration enables immediate ingestion and streaming of telemetry to third-party on-premises or cloud-based SIEM systems.

Step-by-Step Solution

1

Analyze the core requirement

The requirement demands streaming log data to a third-party, external system (on-premises SIEM) in near real-time.

This determines the export pipeline capability required (real-time streaming vs. batch ingestion or internal analysis).

2

Evaluate the supported destinations in Azure Monitor diagnostic settings

Diagnostic settings support exporting to Log Analytics workspaces, Azure Storage accounts, Azure Event Hubs, and partner integrations.

We must match the target destinations with the specific capability identified in the first step.

3

Select the optimal destination

Azure Event Hubs acts as a high-throughput event ingestion service that streams data out of Azure to external consumers instantly.

It is the only native destination designed specifically for streaming telemetry out of Azure in near real-time.

Key Concept

Azure Monitor diagnostic settings export destinations

Rate this question

Topics

Monitoring and Log Routing Solutions