A company deploys a Network Security Group (NSG) named `NSG-Secure`. You are tasked with configuring a diagnostic setting on `NSG-Secure` to meet the following requirements:
- Route NSG rule evaluation events to a storage account named `storeauditprod`.
- Avoid routing any performance metrics or flow logs to the storage account.
- Ensure that the configuration uses the minimum required log categories.
Which configuration should you apply to the diagnostic setting?
- Enable the NetworkSecurityGroupEvent log category and select the Archive to a storage account destination, choosing storeauditprod.Cevap
- BEnable the NetworkSecurityGroupRuleCounter log category and select the Archive to a storage account destination, choosing storeauditprod.
- CEnable the NetworkSecurityGroupEvent log category and select the Send to Log Analytics workspace destination, choosing storeauditprod.
- DEnable the NetworkSecurityGroupEvent log category, select the Archive to a storage account destination choosing storeauditprod, and assign the Storage Blob Data Contributor role to the NSG on storeauditprod.
Cevap
Enable the NetworkSecurityGroupEvent log category and select the Archive to a storage account destination, choosing storeauditprod.
The correct configuration enables the NetworkSecurityGroupEvent log category and selects the 'Archive to a storage account' destination, choosing the storeauditprod storage account. This satisfies all requirements: NetworkSecurityGroupEvent contains the rule evaluation events, archiving to a storage account is the correct destination type for storeauditprod, and no unnecessary metrics or roles are configured.
Adım Adım Çözüm
Anahtar Kavram
Azure Monitor Diagnostic Settings routing and NSG log categories configuration.