Examkin

Soru

Zorluk: OrtaAzure Monitor Metrics and Diagnostic Settings

You have an Azure Bastion host named `bastion-corp-east` that is used to manage virtual machines. You must configure diagnostic logging for the Bastion host to meet the following requirements:

* Capture audit logs for all user remote sessions.
* Retain the session logs for 180 days.
* Ensure the logs can be queried directly using the Kusto Query Language (KQL).

Which diagnostic setting configuration should you implement?

  1. Create a diagnostic setting on `bastion-corp-east` that forwards the `BastionAuditLogs` category to a Log Analytics workspace, and set the data retention period of the workspace to 180 days.Cevap
  2. B
    Create a diagnostic setting on `bastion-corp-east` that forwards the `AllMetrics` category to a Log Analytics workspace, and set the data retention period of the workspace to 180 days.
  3. C
    Create a diagnostic setting on `bastion-corp-east` that forwards the `BastionAuditLogs` category to an Azure Storage account, and configure a 180-day retention period in the diagnostic setting.
  4. D
    Create a diagnostic setting on `bastion-corp-east` that forwards the `BastionAuditLogs` category to an Azure Event Hub, and configure the message retention period of the hub to 180 days.

Cevap

Create a diagnostic setting on `bastion-corp-east` that forwards the `BastionAuditLogs` category to a Log Analytics workspace, and set the data retention period of the workspace to 180 days.
The correct configuration forwards the `BastionAuditLogs` category to a Log Analytics workspace. This workspace natively supports Kusto Query Language (KQL) queries. The data retention period must be managed at the workspace level, which is set to 180 days.

Adım Adım Çözüm

1
Identify the correct log category for Azure Bastion session auditing.
The correct log category is `BastionAuditLogs`, which contains remote session connection details.
Tracking user remote sessions requires capturing audit logs rather than performance metrics (`AllMetrics`).
2
Identify the correct destination for querying logs with Kusto Query Language (KQL).
The destination must be a Log Analytics workspace.
Neither Azure Storage accounts nor Azure Event Hubs support direct, native KQL queries on stored log data.
3
Configure the retention settings for the collected logs.
Set the default data retention on the Log Analytics workspace to 180 days.
Diagnostic settings no longer support built-in retention configuration for storage destinations; retention must be configured on the destination workspace or storage account lifecycle policies.

Anahtar Kavram

Azure Monitor Diagnostic Settings routing and log categories for Azure Bastion, including destination-based retention policies.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Azure Monitor Metrics and Diagnostic Settings

Bu konudan daha fazla soru