Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

You are designing a monitoring and log routing architecture for a large Azure enterprise environment. You need to route different types of Azure logs and metrics to the appropriate destinations to meet specific operational and compliance requirements.

Which destination should you match with each log source to meet the requirements?

  • Database diagnostic logs that must be analyzed in real-time by a third-party SIEM.Azure Event Hubs
  • Subscription activity logs that must be retained for audit compliance for five years at minimum cost.Azure Storage account
  • Virtual machine guest operating system logs that require troubleshooting using Kusto Query Language (KQL).Azure Log Analytics workspace
  • Network Security Group (NSG) flow logs that must be analyzed using Traffic Analytics.Log Analytics workspace with Traffic Analytics enabled

Answer

Database diagnostic logs route to Azure Event Hubs; Subscription activity logs route to Azure Storage account; VM guest OS logs route to Azure Log Analytics workspace; NSG flow logs route to Log Analytics workspace with Traffic Analytics enabled.
Matching database diagnostic logs to Azure Event Hubs allows real-time integration with SIEMs. Matching activity logs to Azure Storage minimizes costs for long-term archival. Matching VM logs to Log Analytics supports KQL troubleshooting. Matching NSG flow logs to Log Analytics with Traffic Analytics enabled provides flow insights.

Step-by-Step Solution

1
Analyze the real-time ingestion requirement for the database diagnostic logs.
Identify that third-party SIEM integration requires low-latency ingestion, which is supported by streaming logs via Azure Event Hubs.
Azure Event Hubs functions as an event pipeline to stream diagnostic data out of Azure.
2
Evaluate the 5-year retention compliance requirement for activity logs.
Determine that archiving to an Azure Storage account is the most cost-effective solution for long-term compliance storage when active querying is not needed.
Log Analytics storage and retention costs are significantly higher than Azure Blob Storage cold or archive tiers.
3
Identify the querying and troubleshooting requirements for VM guest OS logs.
Match this with a standard Azure Log Analytics workspace.
Log Analytics natively integrates with Azure Monitor Agent to collect VM guest logs and provides KQL for querying and alerting.
4
Assess the requirement to run Traffic Analytics on NSG flow logs.
Determine that Traffic Analytics must be enabled on a Log Analytics workspace to process and visualize flow data.
Traffic Analytics relies on Network Watcher flow log data processed into a Log Analytics workspace.

Key Concept

Selecting the optimal destination for Azure diagnostic, activity, and flow logs based on cost, retention, and analytical requirements.

Alternative Method

Analyzing the log destination based on the primary consumer: SIEM consumers require Event Hubs, KQL queries require Log Analytics, and long-term compliance without active query needs requires a Storage Account.
Estimated Time:2m 0s
Rate this question

Topics

Monitoring and Log Routing Solutions