Examkin

Soru

Zorluk: Çok zorAzure Monitor Metrics and Diagnostic Settings

You manage an Azure subscription that contains an Azure Key Vault named `KeyVault1` and an Azure App Service web app named `WebApp1` in the East US region. You must configure diagnostic settings to meet the following logging requirements:
- Audit logs for all cryptographic key operations in `KeyVault1` must be retained for exactly 365 days.
- HTTP server logs from `WebApp1` must be streamed to a non-Azure security information and event management (SIEM) system in near real-time.

Which of the following configuration actions should you perform? (Select TWO.)

  1. Create a diagnostic setting on `WebApp1` to send `AppServiceHTTPLogs` to an Azure Event Hubs namespace.Cevap
  2. Create a diagnostic setting on `KeyVault1` to send `AuditEvent` logs to an Azure storage account, and configure a lifecycle management policy on the storage account.Cevap
  3. C
    Create a diagnostic setting on `KeyVault1` and configure the built-in retention settings slider to 365 days.
  4. D
    Create a diagnostic setting on `WebApp1` to send web server logs to a Log Analytics workspace and configure the workspace data retention period to 365 days.

Cevap

Create a diagnostic setting on the web app to send HTTP logs to an Event Hubs namespace, and create a diagnostic setting on the Key Vault to send audit logs to a storage account managed by a lifecycle policy.
To satisfy the requirements, the App Service HTTP logs must be routed to an Azure Event Hubs namespace to allow near real-time ingestion by the non-Azure SIEM. The Key Vault audit logs, containing cryptographic key operations, are routed to a storage account where a lifecycle management policy controls the exact 365-day retention. This matches current Azure Monitor capabilities where the built-in diagnostic setting retention slider is retired.

Adım Adım Çözüm

1
Analyze the web app logging destination requirement.
Real-time streaming to a non-Azure SIEM system requires an Event Hubs integration.
Log Analytics and Storage Accounts do not support direct, real-time push integration with external third-party SIEM systems without intermediary services, whereas Event Hubs is built for this.
2
Analyze the Key Vault retention requirement.
Determine that the `AuditEvent` category must be sent to a storage account with a lifecycle management policy.
Microsoft has retired the retention settings (days slider) directly within diagnostic settings. Therefore, to enforce a specific retention period like 365 days on archived logs, you must write the logs to a storage account and enforce the retention period via storage lifecycle rules.
3
Evaluate and rule out incorrect options.
Eliminate configurations utilizing the deprecated retention slider or using Log Analytics for external SIEM integration.
This avoids deploying invalid configurations and ensures the solution aligns with current Azure platform behavior.

Anahtar Kavram

Azure Monitor Diagnostic Settings Destinations and Retention
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Azure Monitor Metrics and Diagnostic Settings

Bu konudan daha fazla soru