Your company has an Azure subscription containing an Azure Key Vault named KV1, an Azure Firewall named FW1, and a Network Security Group named NSG1. You must configure diagnostic settings for these resources to satisfy specific organizational requirements. Match each logging or monitoring requirement on the left to its most appropriate Azure Monitor diagnostic settings destination on the right. (Each destination may be used once, more than once, or not at all.)
- Run complex KQL queries to correlate logs across KV1 and other resources to identify security anomalies.Log Analytics workspace
- Archive NSG1 flow logs for a period of two years at the lowest possible storage cost.Azure Storage account
- Stream FW1 activity and resource logs in near real-time to an on-premises third-party SIEM system.Azure Event Hubs
- Export KV1 diagnostic metrics to an external partner SaaS monitoring environment like Datadog.Partner solution
Cevap
Log Analytics workspace matches KQL queries and correlation; Azure Storage account matches lowest cost archiving; Azure Event Hubs matches streaming to an external SIEM; Partner solution matches exporting to Datadog.
Log Analytics workspace is matched to running KQL queries because it is the native query interface for Azure Monitor. Storage account is matched to low-cost archiving because it provides the cheapest long-term raw data storage. Event Hubs is matched to streaming to third-party SIEMs because it serves as the real-time message stream destination. Partner solution is matched to Datadog because Azure Diagnostic Settings support direct partner integration for SaaS monitoring platforms.
Adım Adım Çözüm
Anahtar Kavram
Selecting the correct Azure Monitor diagnostic settings destination based on cost, performance, and integration requirements.