Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

A retail company is designing a monitoring and log routing architecture for its Azure workloads. You need to match each monitoring requirement to its correct Azure Monitor destination or feature. Which destination or feature should you associate with each requirement?

  • Archive subscription-level Azure Activity logs for 5 years to meet regulatory compliance audits at the lowest storage cost.Azure Storage account
  • Stream diagnostic logs from an Azure Application Gateway in near real-time to a third-party SIEM system.Azure Event Hubs
  • Perform complex query analysis and correlation across multiple resources using Kusto Query Language (KQL).Azure Monitor Log Analytics workspace
  • Configure alerts on virtual machine CPU utilization that trigger within a minute of a threshold breach.Azure Monitor Metrics

Answer

Archive subscription-level Azure Activity logs for 5 years to meet regulatory compliance audits at the lowest storage cost matches with Azure Storage account; Stream diagnostic logs from an Azure Application Gateway in near real-time to a third-party SIEM system matches with Azure Event Hubs; Perform complex query analysis and correlation across multiple resources using Kusto Query Language (KQL) matches with Azure Monitor Log Analytics workspace; Configure alerts on virtual machine CPU utilization that trigger within a minute of a threshold breach matches with Azure Monitor Metrics.
The matching pairs correctly align each specific monitoring and alerting requirement to the Azure service designed to address it. Under Azure Monitor diagnostic settings, logs can be routed to a Storage Account for low-cost compliance archiving, Event Hubs for real-time external pipeline integration, or a Log Analytics workspace for KQL query analytics. Time-series metrics are natively written to the Azure Monitor Metrics database to enable sub-minute metric alerts.

Step-by-Step Solution

1
Analyze the log archiving requirement.
Long-term (5-year) compliance retention with the primary constraint of 'lowest storage cost' maps to Azure Storage, as archiving logs to blob storage is significantly cheaper than retaining them in a Log Analytics workspace.
To satisfy retention requirements cost-effectively.
2
Analyze the real-time external streaming requirement.
Streaming diagnostic logs to a third-party, non-Azure SIEM in near real-time is best achieved by routing logs through Azure Event Hubs, which acts as a message broker for ingestion pipelines.
To support external SIEM ingestion.
3
Analyze the query and correlation requirement.
Querying logs via Kusto Query Language (KQL) requires the logs to be stored in an Azure Monitor Log Analytics workspace, which is the native environment for log search and correlation queries.
To enable interactive log querying with KQL.
4
Analyze the near real-time alerting requirement.
Metric alerts targeting fast evaluation times (e.g., under a minute) run against the Azure Monitor Metrics store (a time-series database) rather than Log Analytics logs, providing quicker alert response times.
To minimize latency for infrastructure alerts.

Key Concept

Log routing destinations in Azure Monitor support distinct operational requirements, where Storage Accounts are optimized for cost-effective long-term retention, Event Hubs for real-time external integration, Log Analytics workspaces for rich KQL queries, and Azure Monitor Metrics for low-latency alerting.
Rate this question

Topics

Monitoring and Log Routing Solutions