Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

A financial organization is designing a governance and monitoring solution for its Azure environment. The security team requires that all newly deployed virtual machines and Azure SQL databases automatically route their diagnostic logs to a central Azure Event Hubs namespace for ingestion into a third-party SIEM. The solution must ensure that resource deployments by application teams are never blocked, and any resource deployed without a diagnostic setting is automatically corrected to comply with the logging requirement.

Which configuration should you recommend?

  1. An Azure Policy definition with the DeployIfNotExists effect that deploys diagnostic settings pointing to the Event Hubs namespace, assigned at the subscription level.Answer
  2. B
    An Azure Policy definition with the Deny effect that blocks resource deployment if the diagnostic setting pointing to the Event Hubs namespace is not present in the deployment template.
  3. C
    An Azure Policy definition with the Audit effect to flag missing diagnostic settings, with the remediation task running under a custom contributor role assigned directly to individual administrator user accounts.
  4. D
    An Azure Policy definition with the DeployIfNotExists effect configured to route all VM and database logs to a single centralized Log Analytics workspace across all production and non-production subscriptions, ignoring regulatory segregation requirements.

Answer

An Azure Policy definition with the DeployIfNotExists effect that deploys diagnostic settings pointing to the Event Hubs namespace, assigned at the subscription level.
The correct configuration uses Azure Policy with the DeployIfNotExists effect assigned at the subscription level. This effect allows the resource deployment to proceed normally and automatically deploys diagnostic settings to route logs to the Event Hubs namespace if they are missing, satisfying the non-blocking and automated remediation requirements.

Step-by-Step Solution

1
Determine the appropriate Azure Policy effect to satisfy the non-blocking automation requirement.
DeployIfNotExists is selected over Deny because it automatically remediates non-compliant resources upon creation without blocking the deployment.
The requirement specifies that resource deployments must never be blocked, ruling out the Deny effect.
2
Define the target destination for the diagnostic logs.
The policy must deploy diagnostic settings configured to send logs to the Azure Event Hubs namespace.
The organization requires logs to be routed to an Event Hubs namespace for ingestion into a third-party SIEM.
3
Assign the policy at the subscription scope.
The policy is assigned to the subscription level to cover all newly deployed virtual machines and Azure SQL databases.
Assigning at the subscription level ensures governance compliance for all resources under that subscription.

Key Concept

Azure Policy DeployIfNotExists effect for automatic diagnostic setting deployment and log routing compliance.
Rate this question

Topics

Monitoring and Log Routing Solutions