Examkin

Question

Difficulty: HardMonitoring and Log Routing Solutions

A retail company's e-commerce platform consists of Azure App Service instances and Azure SQL databases. The compliance and operations teams establish the following requirements for diagnostic data:

- Database audit logs and Web Application Firewall (WAF) logs must be retained for seven years in a cost-optimized storage tier.
- The Security Operations Center (SOC) must receive real-time streams of all security events in an on-premises SIEM.
- Database administrators (DBAs) must be able to query database performance logs without viewing application transaction or security logs.

Which design should you recommend for log routing and access control?

  1. Configure diagnostic settings to send security events to Azure Event Hubs, route audit and WAF logs to Azure Storage with archive lifecycle rules, and send performance logs to a centralized Log Analytics workspace configured to use resource-context RBAC.Answer
  2. B
    Configure diagnostic settings to route all logs to a single centralized Log Analytics workspace, configure workspace-context RBAC to restrict DBA query access to specific tables, and use Azure Monitor data export to stream events directly to the on-premises SIEM.
  3. C
    Configure diagnostic settings to route performance logs to a Log Analytics workspace, send WAF and audit logs to Azure Storage, and assign the Monitoring Reader role directly to the Azure Entra user accounts of individual DBAs.
  4. D
    Configure diagnostic settings to route performance logs to individual Log Analytics workspaces created for each DBA, and implement an Azure Policy with a Deny effect to block databases that lack diagnostic settings.

Answer

Configure diagnostic settings to stream security events to Azure Event Hubs, store audit and WAF logs in Azure Storage with archive lifecycle rules, and send performance logs to a centralized Log Analytics workspace using resource-context access control.
The correct design uses Azure Event Hubs to stream security events to the on-premises SIEM, Azure Storage with archive lifecycle rules for long-term audit/WAF log retention, and resource-context RBAC within a central Log Analytics workspace to isolate database performance logs for DBAs.

Step-by-Step Solution

1
Analyze log retention and cost requirements
Determine that database audit and WAF logs, which require seven-year retention, should be routed to Azure Storage with lifecycle policies to minimize costs.
Azure Storage is significantly more cost-effective for long-term retention than Log Analytics workspaces.
2
Address SIEM integration requirements
Determine that security events must be routed to Azure Event Hubs.
Azure Event Hubs provides low-latency streaming capabilities suitable for ingestion by external on-premises SIEM systems.
3
Determine the access model for DBAs querying performance logs
Select a centralized Log Analytics workspace configured with resource-context RBAC.
Resource-context RBAC automatically restricts users to only querying logs for resources they are authorized to access, avoiding the need for separate workspaces or complex workspace-level permissions.

Key Concept

Log routing architecture, cost optimization, and access isolation in Azure Monitor
Estimated Time:2m 30s
Rate this question

Topics

Monitoring and Log Routing Solutions