Examkin

Soru

Zorluk: Çok zorImplement Azure Monitor Alerts and Action Groups

You are designing a monitoring and remediation strategy for an enterprise web application hosted on Azure App Service. The application logs exceptions to an Application Insights workspace.

You need to implement an Azure Monitor Log Search Alert rule that triggers when the exception rate exceeds a specific threshold. The alert must execute the following workflow:
1. Dynamically email all users who hold the built-in 'Monitoring Contributor' role at the subscription level.
2. Invoke an automated remediation service hosted on an Azure Function App. This endpoint is secured using Microsoft Entra ID authentication.
3. Minimize query overhead and avoid duplicate filtering in the underlying Kusto Query Language (KQL) query execution.

Which 33 configurations must you implement to meet these requirements?

  1. In the Action Group, add an action of type 'Email Azure Resource Manager Role' and select the 'Monitoring Contributor' role.Cevap
  2. In the Action Group, add an action of type 'Webhook', enable Microsoft Entra ID authentication, and specify the Tenant ID, Object ID of the service principal, and the Identifier URI of the secured endpoint.Cevap
  3. In the Log Search Alert rule, write a KQL query that excludes any explicit temporal filter (such as where timestamp > ago(...)), allowing the rule's aggregation parameters to control the query window.Cevap
  4. D
    In the Action Group, add an action of type 'Azure Function', enable Microsoft Entra ID authentication, and provide the service principal details of the target Function App.
  5. E
    In the Log Search Alert rule's KQL query, include a 'where timestamp > ago(5m)' clause to explicitly restrict the scanned telemetry to the 55-minute evaluation period.
  6. F
    In the Action Group, add an action of type 'Email/SMS/Push/Voice', select 'Email', and manually add the individual email addresses of all team members currently holding the 'Monitoring Contributor' role.

Cevap

To meet the requirements, you must add an 'Email Azure Resource Manager Role' action to the Action Group for the 'Monitoring Contributor' role, use a 'Webhook' action type with Microsoft Entra ID authentication enabled to trigger the secured Azure Function, and omit manual time filters from the alert rule's KQL query.
Implementing a dynamic notification requires the 'Email Azure Resource Manager Role' type to map roles dynamically. Calling an Entra ID-secured Azure Function requires using the Webhook action type, as the direct Azure Function receiver only supports host/function key authentication. Lastly, KQL queries for alert rules should not contain manual time filters, as Azure Monitor automatically appends the target time window based on the rule parameters.

Adım Adım Çözüm

1
Address the notification requirement dynamically using Azure RBAC roles.
Create an action within the Action Group of type 'Email Azure Resource Manager Role' targeting 'Monitoring Contributor'. This ensures any user with the role is automatically emailed.
Hardcoding individual emails makes the system static and hard to maintain, while the ARM role receiver dynamically evaluates membership.
2
Select the correct Action Group receiver for Microsoft Entra ID secured endpoints.
Create a 'Webhook' action type, enable Microsoft Entra ID authentication, and configure the tenant, object ID, and audience URI.
Although the target is an Azure Function, the native 'Azure Function' action type in Action Groups does not support Entra ID authentication; the 'Webhook' action type must be used to send authenticated payloads.
3
Optimize the KQL query by leveraging the alert rule's native evaluation parameters.
Write the KQL query without any timestamp filters (like 'ago()').
Azure Monitor automatically appends the time bounds based on the alert rule's lookback period. Adding them manually overrides these parameters and can cause incorrect or slow evaluations.

Anahtar Kavram

Azure Monitor Action Groups support securing webhook actions using Microsoft Entra ID authentication, but this capability is not natively present in the direct Azure Function action type. Additionally, Log Search Alert KQL queries must omit manual time bounds as Azure Monitor manages the query period automatically.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Implement Azure Monitor Alerts and Action Groups

Bu konudan daha fazla soru