Examkin

Question

Difficulty: HardMonitoring and Log Routing Solutions

An enterprise is designing a monitoring and log routing architecture for its Azure workloads to meet various operational and compliance requirements. Match each logging scenario to the most appropriate Azure Monitor routing configuration.

  • Collect guest OS performance metrics and system logs from on-premises and Azure virtual machines for correlation using KQL.Azure Monitor Agent (AMA) and Data Collection Rules (DCR) routing to a Log Analytics workspace
  • Stream HTTP access logs from an Azure App Service instance to an external, third-party Security Information and Event Management (SIEM) system with minimal latency.Diagnostic Settings routing to an Azure Event Hubs namespace
  • Store Azure SQL Database diagnostic telemetry for a mandatory 5-year compliance audit at the lowest possible storage cost.Diagnostic Settings routing to an Azure Storage account with lifecycle management
  • Consolidate and search Microsoft Entra ID sign-in activity and directory audit logs across the entire directory tenant.Tenant-level Diagnostic Settings routing to a centralized Log Analytics workspace

Answer

Match guest OS metrics to Azure Monitor Agent and DCRs; stream App Service HTTP logs to Azure Event Hubs; store SQL Database logs in Azure Storage with lifecycle management; and consolidate Microsoft Entra ID logs via tenant-level Diagnostic Settings.
Matching guest OS logs to the Azure Monitor Agent and DCRs ensures proper agent-based telemetry collection. Streaming App Service HTTP logs to an Event Hub satisfies real-time SIEM ingestion. Archiving SQL Database logs in an Azure Storage account with lifecycle policies minimizes costs for 5-year retention. Consolidating Microsoft Entra ID logs requires tenant-level diagnostic settings to span across the entire tenant directory.

Step-by-Step Solution

1
Identify the source of the logs (guest OS level vs platform level vs tenant level) and the target destination requirements (interactive queries vs low-cost archiving vs real-time external ingestion).
Categorize the four requirements: VM guest OS needs agent collection; SIEM requires real-time streaming; compliance audit needs low-cost long-term retention; Entra ID needs tenant-scope collection.
Correctly classifying log scopes ensures you choose the appropriate diagnostic setting level and target endpoint.
2
Match VM guest collection to its specific tool.
The Azure Monitor Agent (AMA) with Data Collection Rules (DCRs) is the designated mechanism for VM guest OS logs and metrics targeting a Log Analytics workspace.
Diagnostic settings only collect host-level metrics for virtual machines, whereas guest-level logs require the agent.
3
Match real-time external SIEM integration to the appropriate streaming component.
Azure Event Hubs acts as the real-time event pipeline for routing logs to third-party SIEM tools.
Log Analytics and Storage accounts are not designed for direct real-time push streaming to external non-Azure SIEM systems.
4
Match long-term compliance storage to the most cost-effective option.
Azure Storage accounts with lifecycle management policies provide the lowest cost for long-term retention (e.g., 5 years) compared to Log Analytics workspaces.
Log Analytics has higher ingestion and retention costs, making Storage accounts the preferred choice for compliance archiving.
5
Match tenant-level logs to their appropriate diagnostic scope.
Microsoft Entra ID logs are tenant-level resources and require tenant-level diagnostic settings to be sent to a Log Analytics workspace.
Subscription-level diagnostic settings do not capture tenant-wide directory audit or sign-in logs.

Key Concept

Selecting appropriate Azure log routing mechanisms based on log scope (guest, platform, tenant) and operational targets (KQL analysis, low-cost archive, real-time SIEM streaming).
Estimated Time:3m 0s
Rate this question

Topics

Monitoring and Log Routing Solutions