Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

A healthcare provider is deploying a new web application on Azure App Service. The compliance team mandates that web server logs must be retained for seven years in a WORM (Write Once, Read Many) state to meet regulatory audits. Additionally, the security operations center (SOC) requires real-time log streaming to an on-premises Security Information and Event Management (SIEM) system. Which log routing design should you recommend to meet these requirements?

  1. A
    Configure a diagnostic setting on the App Service to route logs to an Azure Log Analytics workspace with a seven-year retention policy configured.
  2. B
    Deploy an Azure Policy with a Deny effect to block App Service deployments unless they are pre-configured to send logs directly to the on-premises SIEM.
  3. Configure a diagnostic setting on the App Service to stream logs to an Azure Event Hubs namespace for SIEM integration, and to an Azure Storage account with time-based retention policies in immutable storage for archival.Answer
  4. D
    Configure a diagnostic setting to send logs to a Log Analytics workspace, and grant the Monitoring Reader role directly to the individual Azure AD user accounts of the Security Operations Center analysts.

Answer

Configure a diagnostic setting on the App Service to stream logs to an Azure Event Hubs namespace for SIEM integration, and to an Azure Storage account with time-based retention policies in immutable storage for archival.
Routing logs to Azure Event Hubs ensures the real-time streaming requirement for the on-premises SIEM is met, while simultaneously routing to Azure Storage with time-based immutable policies satisfies the seven-year WORM archival requirement in a highly cost-efficient manner.

Step-by-Step Solution

1
Identify the real-time streaming requirement.
Azure Event Hubs is selected as the destination to stream log data to an external, on-premises SIEM in real-time.
Event Hubs acts as the ingestion point for large-scale, real-time log streaming to third-party or on-premises systems.
2
Address the WORM storage and retention requirement.
Azure Blob Storage with immutable storage (time-based retention) is selected for the 7-year archival period.
Immutable storage in Azure Storage accounts provides compliance-grade WORM storage at a highly cost-effective rate compared to active workspace ingestion.
3
Combine the routing mechanisms into a single design.
A diagnostic setting is defined on the App Service that routes logs to both destinations simultaneously.
Azure Monitor diagnostic settings support sending log data to multiple endpoints (Event Hubs, Storage Account, Log Analytics) at the same time.

Key Concept

Azure Monitor diagnostic settings enable routing log data to multiple destinations, including Event Hubs for real-time streaming and Storage Accounts for immutable, cost-effective compliance archiving.
Estimated Time:2m 0s
Rate this question

Topics

Monitoring and Log Routing Solutions