Examkin

Question

Difficulty: Very hardMonitoring and Log Routing Solutions

You are designing a centralized monitoring and log routing architecture for an enterprise with multiple Azure subscriptions. You need to map each corporate log management requirement to its optimal Azure service architecture. Each configuration must satisfy the constraints while minimizing administrative overhead and cost.

Match each operational requirement on the left to the most appropriate Azure architecture design on the right.

  • Azure Activity logs from all subscriptions must be retained for 77 years for regulatory audit compliance. The logs are rarely accessed, and minimizing long-term storage costs is the primary concern.A centralized Azure Storage account configured with immutable blob storage and a lifecycle management policy to transition data to the Archive tier.
  • Resource diagnostic logs must be processed in near real-time by a third-party SIEM system located on-premises. You must avoid duplicate data storage charges within Azure.An Azure Event Hubs namespace that streams data directly to the on-premises environment without persisting logs to a workspace.
  • Virtual machine security event logs from all environments must be ingested for analysis with Microsoft Sentinel. Non-security administrators must be blocked from viewing these security logs.A dedicated, centralized Log Analytics workspace with Microsoft Sentinel enabled and workspace-context RBAC applied.
  • High-volume web application console logs from resources in multiple regions are needed for KQL-based troubleshooting for up to 1010 days. You must minimize ingestion costs and avoid cross-region network egress charges.Regional Log Analytics workspaces with diagnostic settings routing logs to tables configured for the Basic Logs plan.

Answer

The requirement for 77-year Activity log storage matches the centralized Storage account with Archive tier lifecycle. The requirement for real-time SIEM streaming matches the Event Hubs direct routing. The VM security logs requirement matches the dedicated workspace with Sentinel and workspace-context RBAC. The regional developer debugging requirement matches regional workspaces configured with the Basic Logs plan.
The correct matches align Azure monitoring features to business constraints: Storage Archive tier for compliance log retention; Event Hubs for real-time external SIEM streaming; dedicated Sentinel workspace with workspace-context RBAC for SecOps isolation; and regional workspaces with Basic Logs tables for low-cost, egress-free developer debugging.

Step-by-Step Solution

1
Evaluate long-term audit logs path.
Identify that Azure Storage Archive tier offers the lowest cost per gigabyte for 77-year compliance storage of rarely accessed Activity logs.
Log Analytics and Event Hubs are optimized for querying and streaming, making them cost-prohibitive for inactive multi-year archival storage.
2
Analyze near real-time SIEM streaming.
Route the logs to Azure Event Hubs as a diagnostic setting destination without routing them to Log Analytics first.
This configuration satisfies the real-time consumption requirement of the on-premises SIEM while avoiding storage and double-ingestion fees in Azure.
3
Address central security logging with Sentinel and access control.
Design a dedicated centralized Log Analytics workspace with Sentinel and apply workspace-context RBAC.
Microsoft Sentinel operates at the workspace level. Using a dedicated workspace and workspace-context RBAC ensures security data is isolated from resource administrators who otherwise could view resource-context logs.
4
Optimize developer troubleshooting logs across regions.
Use regional Log Analytics workspaces and configure the target log tables to the Basic Logs plan.
Regional workspaces eliminate cross-region egress data transfer charges for log ingestion, and the Basic Logs plan dramatically reduces ingestion costs for high-volume logs that are only needed for short-term debugging.

Key Concept

Designing cost-effective, secure, and performant log routing configurations in Azure using Storage, Event Hubs, and Log Analytics plans.
Rate this question

Topics

Monitoring and Log Routing Solutions