Examkin

Question

Difficulty: Very hardMonitoring and Log Routing Solutions

An enterprise is designing a comprehensive monitoring and log routing architecture to support workloads across multiple Azure regions. Match each specific logging requirement to its correct Azure architectural design configuration.

  • Route Security Event logs from virtual machines in multiple regions to an on-premises SIEM platform while minimizing cross-region data transfer latency.Configure diagnostic settings to send logs to regional Azure Event Hubs namespaces, which stream data to the external collectors.
  • Consolidate App Service logs across multiple subscriptions into one workspace, ensuring developers can query only their application's logs without workspace access.Use a single centralized Log Analytics workspace and rely on Resource-context RBAC settings on the workspace.
  • Retain Azure Activity logs for 10 years to meet regulatory compliance requirements, ensuring logs cannot be modified or deleted, while minimizing storage costs.Route logs to an Azure Storage account configured with a Write Once, Read Many (WORM) policy in the archive tier.
  • Collect Syslog data from virtual machines while excluding all debug-level entries prior to ingestion to minimize workspace ingestion volume charges.Deploy the Azure Monitor Agent and apply a Data Collection Rule containing a KQL transformation query.

Answer

Route SIEM logs to regional Event Hubs; route app logs to centralized Log Analytics with Resource-context RBAC; route long-term compliance logs to Storage with WORM policy; route VM logs via Azure Monitor Agent with DCR filter.
Matching the scenarios to their target log routing destinations ensures cost efficiency, data residency compliance, and proper access control boundaries. Real-time SIEM integration requires Event Hubs; multi-subscription developer access is secured using resource-context RBAC; low-cost immutable storage is achieved with Storage accounts; pre-ingestion filtering requires Azure Monitor Agent with a Data Collection Rule.

Step-by-Step Solution

1
Analyze SIEM logging requirements. Determine that Event Hubs is required for real-time streaming, and regional namespaces minimize cross-region egress costs.
Map VM SIEM logs to regional Event Hubs.
Reduces latency and cost for external SIEM integration.
2
Analyze developer access requirements. Evaluate workspace-context vs resource-context RBAC.
Map cross-subscription app logs to centralized Log Analytics with Resource-context RBAC.
Allows developers to access resource logs without granting access to the workspace.
3
Analyze compliance retention requirements. Compare Log Analytics retention costs with Azure Storage.
Map 10-year activity logs to an Azure Storage account with WORM policy.
Azure Storage provides the lowest-cost long-term retention and supports immutable (WORM) storage.
4
Analyze syslog filtering requirements. Evaluate how to filter logs before workspace ingestion.
Map syslog collection to Azure Monitor Agent (AMA) with a Data Collection Rule (DCR) and KQL transformation.
DCR transformations run before ingestion, filtering out debug logs to save on ingestion costs.

Key Concept

Azure Monitor architecture design including log routing, data retention, access control (RBAC), and filtering via Data Collection Rules.
Rate this question

Topics

Monitoring and Log Routing Solutions