Examkin

Question

Difficulty: HardMonitoring and Log Routing Solutions

An enterprise is designing a centralized monitoring and log routing architecture for its Azure environment. The architecture must accommodate various auditing, security, and networking logs while satisfying constraints around operational cost, real-time analysis, administrative access control, and long-term retention.

Match each log routing requirement scenario on the left with the most appropriate Azure destination or architectural configuration on the right.

  • Virtual Network flow logs requiring flow visualization, traffic patterns analysis, and a 7-year data retention compliance policy.A Storage Account serving as the target for Network Watcher flow logs, integrated with a Log Analytics Workspace that has Traffic Analytics enabled.
  • Near-real-time streaming of Microsoft Entra ID security logs to a third-party, non-Azure Security Information and Event Management (SIEM) system.An Azure Event Hubs namespace configured in the Diagnostic Settings of the tenant to stream logs to an external partner integration.
  • Diagnostic logs from Azure Key Vaults and App Services across multiple subscriptions that require joint querying while keeping access restricted based on resource-level permissions.A centralized Log Analytics Workspace using the resource-context access control mode, targeted by Resource Diagnostic Settings.
  • Archiving of subscription-wide administrative operation events (write, delete, and action actions) for low-cost compliance storage over several years.A dedicated Storage Account with configured lifecycle management rules, acting as the target for subscription Activity Logs.

Answer

The correct matches pair: (1) Virtual Network flow logs requiring Traffic Analytics and 7-year retention with a Storage Account target for Network Watcher flow logs integrated with Traffic Analytics in a Log Analytics Workspace; (2) Microsoft Entra ID log streaming to a third-party SIEM with an Azure Event Hubs namespace; (3) Centralized resource diagnostic querying with resource-level permissions to a centralized Log Analytics Workspace using resource-context access control; (4) Low-cost Activity Log archiving with a dedicated Storage Account with lifecycle management rules.
The correct matches map each log source and constraint to the appropriate architectural endpoint: Event Hubs for external SIEM streaming, resource-context Log Analytics Workspaces for decentralized querying with RBAC controls, Network Watcher flow logs to Storage plus Traffic Analytics for flow analysis, and Storage Accounts with lifecycle rules for long-term Activity Log archiving.

Step-by-Step Solution

1
Identify the destination for third-party SIEM integration.
Azure Event Hubs is the standard ingress/egress mechanism for streaming Azure platform logs to external partner SIEMs in real-time.
Log Analytics and Storage Accounts do not natively push logs to external SIEMs in near-real-time without intermediary compute or custom agents.
2
Analyze administrative boundary requirements for diagnostic logs.
A centralized Log Analytics Workspace configured with resource-context RBAC allows users to query logs for resources they own without having access to the entire workspace.
This satisfies the requirement for joint querying across subscriptions while respecting resource-level administrative access control.
3
Determine the optimal routing for VNet flow analysis and long-term retention.
Network Watcher flow logs must be written to a Storage Account first, which can then be ingested by a Log Analytics Workspace with Traffic Analytics enabled for visualization.
The Storage Account handles the low-cost raw data retention (7 years), while Traffic Analytics handles the operational flow analysis.
4
Select the storage target for subscription-level Activity Log archiving.
Azure Storage Accounts with lifecycle management policies are the most cost-effective target for long-term archiving of Activity Logs.
Activity Logs represent subscription-wide control-plane events, and storing them in Log Analytics for long periods would incur unnecessarily high costs.

Key Concept

Designing Azure Monitor diagnostic log routing architecture and access control models to meet compliance, security, and administrative isolation requirements.
Rate this question

Topics

Monitoring and Log Routing Solutions