An enterprise is designing a centralized monitoring and log routing architecture for their Azure workloads. The architecture must satisfy specific storage, analytics, and cost requirements. Match each log source and business requirement on the left to its correct Azure destination or configuration on the right.
- OS-level syslog and performance data from Azure Virtual Machines where specific events must be filtered at the source to minimize workspace ingestion costs.Azure Monitor Agent (AMA) with Data Collection Rules (DCRs) routing to a Log Analytics workspace
- Azure subscription-level resource management actions that must be archived for 5 years for audit compliance at the lowest storage cost.Azure Storage account with lifecycle management policies configured
- Near-real-time resource diagnostic logs that must be immediately streamed to an external, non-Azure Security Information and Event Management (SIEM) system.Azure Event Hubs namespace
- Virtual Network traffic flows that must be analyzed to identify traffic patterns, security anomalies, and bandwidth hotspots.Log Analytics workspace with Azure Network Watcher Traffic Analytics enabled
Answer
OS-level syslog with source filtering matches Azure Monitor Agent with Data Collection Rules; subscription-level activity logs for 5-year archive match Azure Storage account with lifecycle management; near-real-time external SIEM integration matches Azure Event Hubs; and virtual network traffic analysis matches Log Analytics with Traffic Analytics enabled.
The correct pairings map the requirements to the respective Azure monitoring features that best satisfy the specified constraints: DCRs for source filtering, Storage accounts for low-cost archival, Event Hubs for real-time external streaming, and Traffic Analytics for deep network flow insights.
Step-by-Step Solution
Key Concept
Azure Monitor Log Routing Architecture
Estimated Time:2m 0s