Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

Your enterprise is designing a monitoring and log routing solution. You need to match each monitoring requirement to the correct Azure service or configuration that satisfies the requirement at the lowest cost and complexity.

Match each log routing requirement on the left to its most appropriate Azure resource or configuration on the right.

  • Stream Azure Key Vault diagnostic logs to a non-Azure SIEM system with sub-minute latencyAzure Event Hubs
  • Retain Virtual Network flow logs for 77 years to meet regulatory compliance at the lowest possible costAzure Storage Account
  • Collect system event logs from both Azure virtual machines and on-premises physical servers in a unified repositoryLog Analytics workspace with the Azure Monitor Agent installed on servers
  • Store resource logs in a repository that supports Kusto Query Language (KQL) for ad-hoc troubleshootingLog Analytics workspace without agent-based collection requirements

Answer

Stream diagnostic logs to SIEM matches Azure Event Hubs; Retain flow logs for 77 years matches Azure Storage Account; Collect logs from hybrid servers matches Log Analytics workspace with the Azure Monitor Agent; Store logs for KQL queries matches Log Analytics workspace.
Streaming logs to SIEM maps to Azure Event Hubs because it acts as an ingestion pipeline for third-party consumers. Multi-year low-cost archiving maps to Azure Storage Accounts. Hybrid event collection maps to the Azure Monitor Agent since it supports both Azure VMs and on-premises servers. Ad-hoc querying via KQL maps directly to Log Analytics workspace storage.

Step-by-Step Solution

1
Analyze the real-time SIEM ingestion requirement.
Identify that streaming logs to non-Azure destinations in near real-time requires an event pipeline.
Azure Event Hubs is the standard broker for routing diagnostic data to third-party SIEM providers.
2
Evaluate the 77-year long-term log retention requirement under cost constraints.
Identify that Log Analytics is too expensive for long-term passive retention, whereas Storage Accounts are cost-efficient.
An Azure Storage Account with cool or archive tier is the lowest-cost option for multi-year retention compliance.
3
Examine the hybrid collection requirement for virtual and physical servers.
Determine the agent needed to bridge Azure and on-premises workloads.
The Azure Monitor Agent (AMA) supports both Azure VMs and hybrid physical servers (via Azure Arc) to collect and forward logs to a Log Analytics workspace.
4
Analyze the interactive KQL query requirement.
Identify the repository that natively exposes a KQL query engine.
A Log Analytics workspace stores log data in structured tables that can be queried directly using Kusto Query Language (KQL).

Key Concept

Selecting log routing targets and collection mechanisms in Azure Monitor based on latency, cost, hybrid scope, and query requirements.
Estimated Time:2m 0s
Rate this question

Topics

Monitoring and Log Routing Solutions