Examkin

Soru

Zorluk: ZorAzure Monitor Alerts and Action Groups

You are configuring monitoring for an Azure subscription. Match each operational alerting requirement to the most appropriate Azure Monitor alert signal type and action group configuration.

  • Detect when an administrator deletes a production virtual machine, and trigger a secure external API endpoint that requires Microsoft Entra ID authentication.Activity Log alert combined with an Action Group containing a Secure Webhook action.
  • Monitor a virtual machine for CPU spikes exceeding 95%95\% and notify the operations team immediately, taking into account the rate limit of 11 message per 55 minutes.Metric alert combined with an Action Group containing an SMS notification action.
  • Analyze database queries in a Log Analytics workspace and execute a recovery workflow when a specific error code appears more than 1010 times in a 55-minute interval.Log Search alert combined with an Action Group containing a Logic App action.

Cevap

The requirement for VM deletion matches with the Activity Log alert and Secure Webhook action. The CPU spike monitoring matches with the Metric alert and SMS action. The log analytics database error query matches with the Log Search alert and Logic App action.
The correct mapping pairs the Activity Log alert with the Secure Webhook for administrative tasks requiring authentication, the Metric alert with SMS for resource performance monitoring subject to standard rate limits, and the Log Search alert with Logic Apps for processing logs and orchestrating workflows.

Adım Adım Çözüm

1
Analyze the signal source for the VM deletion requirement.
Since VM deletion is an administrative action, it is captured in the Azure Activity Log, indicating that an Activity Log alert is required. The requirement to trigger a secure external API endpoint that requires authentication points to a Secure Webhook.
Secure Webhooks allow Azure Monitor to authenticate to APIs secured by Microsoft Entra ID.
2
Analyze the signal source for the CPU spike requirement.
CPU utilization is a platform metric emitted to Azure Monitor Metrics, indicating a Metric alert should be used. The rate limit of 11 message per 55 minutes matches the standard rate limiting behavior of the SMS notification type in Action Groups.
Metric alerts evaluate CPU metrics with low latency, and SMS notifications are throttled to 11 SMS every 55 minutes to prevent spamming.
3
Analyze the signal source for the database error requirement.
Queries running against logs in Log Analytics workspaces are processed using Log Search alerts. A multi-step recovery workflow can be triggered by calling a Logic App from the Action Group.
Log Search alerts are designed to query log data at specified intervals, and Logic Apps are suitable for running automation orchestrations.

Anahtar Kavram

Azure Monitor Alerts (Metric, Log Search, Activity Log) and Action Group actions (Secure Webhook, SMS, Logic App) have specific signal source mapping and behavioral/rate limits.
Bu soruyu puanla

Konular

Azure Monitor Alerts and Action Groups

Bu konudan daha fazla soru