Examkin

Soru

Zorluk: Çok zorAzure Monitor Metrics and Diagnostic Settings

Your company's security policy requires auditing all read, write, and delete operations on blobs in a production storage account named `storeprod1`. The audit logs must be queryable using KQL and retained for exactly 365 days. You need to configure the monitoring solution while minimizing management overhead and ensuring cost-effectiveness. Which configuration should you implement?

  1. A
    Configure a diagnostic setting on the `storeprod1` storage account resource to send `StorageRead`, `StorageWrite`, and `StorageDelete` logs to the `law-prod1` Log Analytics workspace, and set the retention policy in the diagnostic setting to 365 days.
  2. B
    Configure a diagnostic setting on the `storeprod1/blobServices/default` resource to send transaction metrics to the `law-prod1` Log Analytics workspace, and set the retention policy in the diagnostic setting to 365 days.
  3. Configure a diagnostic setting on the `storeprod1/blobServices/default` resource to send `StorageRead`, `StorageWrite`, and `StorageDelete` logs to the `law-prod1` Log Analytics workspace, and set the data retention of `law-prod1` to 365 days.Cevap
  4. D
    Create a lifecycle management rule on the `storeprod1` storage account to tier log blobs, and assign the Storage Blob Data Reader role to the `law-prod1` system-assigned managed identity.

Cevap

Configure a diagnostic setting on the `storeprod1/blobServices/default` resource to send `StorageRead`, `StorageWrite`, and `StorageDelete` logs to the `law-prod1` Log Analytics workspace, and set the data retention of `law-prod1` to 365 days.
To collect blob-level transaction logs (read, write, delete), the diagnostic setting must be configured on the service-specific sub-resource `storeprod1/blobServices/default` rather than the parent storage account. Additionally, since the retention setting in diagnostic settings has been deprecated, the 365-day retention requirement must be configured directly on the destination Log Analytics workspace (`law-prod1`).

Adım Adım Çözüm

1
Identify the correct resource scope for collecting blob storage resource logs.
The scope must be the blob service sub-resource `storeprod1/blobServices/default` rather than the parent storage account `storeprod1`.
Parent storage accounts only support metric collections, while resource logs (such as StorageRead, StorageWrite, StorageDelete) are only available at the service-specific sub-resource level.
2
Identify the correct log categories required to meet the security policy.
Select `StorageRead`, `StorageWrite`, and `StorageDelete` log categories.
These categories contain the logs for data plane read, write, and delete operations on blobs.
3
Determine how to satisfy the 365-day retention requirement.
Set the retention period on the target Log Analytics workspace `law-prod1` to 365 days.
Retention settings in diagnostic settings are deprecated and ignored. Data retention must be managed at the destination workspace level.

Anahtar Kavram

Configuring diagnostic settings for Azure Storage account resource logs and managing log retention at the destination.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Azure Monitor Metrics and Diagnostic Settings

Bu konudan daha fazla soru