Examkin

Soru

Zorluk: Çok zorImplement Azure Monitor Alerts and Action Groups

An enterprise web application hosted on Azure App Service is instrumented with Application Insights. You are implementing an Azure Monitor Log Search Alert rule to monitor server-side errors. The alert rule must trigger an Action Group if the percentage of HTTP 5xx responses exceeds 5%5\% of the total requests over a rolling 15-minute window, evaluated every 5 minutes.

The alert rule condition is configured with the following properties:
- Measure: Metric measurement
- Metric column: ErrorRate
- Aggregation type: Average
- Aggregation granularity (Period): 15 minutes
- Frequency of evaluation: 5 minutes

Which of the following configurations should you implement to satisfy the monitoring requirement and ensure telemetry ingestion and alert execution are successful?

  1. Use a KQL query that groups by 'bin(timestamp, 5m)' and projects 'timestamp' and 'ErrorRate' without any time-range filter clause, and configure the web app with the 'APPLICATIONINSIGHTS_CONNECTION_STRING' app setting.Cevap
  2. B
    Use a KQL query that filters for 'timestamp > ago(15m)' before grouping by 'bin(timestamp, 5m)', and configure the web app with the 'APPLICATIONINSIGHTS_CONNECTION_STRING' app setting.
  3. C
    Use a KQL query that groups by 'bin(timestamp, 5m)' and projects 'timestamp' and 'ErrorRate' without any time-range filter clause, and initialize the Application Insights SDK in code without setting the connection string, relying on parameterless initialization.
  4. D
    Use a KQL query that groups by 'bin(timestamp, 5m)' and projects 'timestamp' and 'ErrorRate' without any time-range filter clause, and configure the action group to use a secure webhook that retrieves its client secret from Key Vault using a key vault reference, without assigning a 'Get Secret' permission to the Azure Monitor service principal.

Cevap

Use a KQL query that groups by 'bin(timestamp, 5m)' and projects 'timestamp' and 'ErrorRate' without any time-range filter clause, and configure the web app with the 'APPLICATIONINSIGHTS_CONNECTION_STRING' app setting.
The correct configuration uses a query that summarizes the error rate using 'bin(timestamp, 5m)' and projects 'timestamp' alongside 'ErrorRate' without a hardcoded time-range filter. It also relies on the 'APPLICATIONINSIGHTS_CONNECTION_STRING' setting to successfully stream application logs to Application Insights. This satisfies all configuration best practices and ensures successful alert operation.

Adım Adım Çözüm

1
Analyze KQL query structure requirements for Azure Monitor Log Search Alerts.
Identify that for Metric Measurement alerts, the query must project a timestamp column (e.g., 'timestamp') and a metric value column (e.g., 'ErrorRate'). The query should not include hardcoded time filters like 'ago(15m)' because Azure Monitor automatically handles the time-range filtering based on the rule configuration.
Hardcoding the time-range in KQL can cause redundant filtering or incorrect evaluations if the alert evaluation window is updated in the rule settings.
2
Determine telemetry collection pre-requisites.
Ensure Application Insights is correctly configured. A connection string must be supplied to the SDK (often via the 'APPLICATIONINSIGHTS_CONNECTION_STRING' application setting in Azure App Service).
Without a valid connection string, telemetry is not sent to Application Insights, meaning the 'requests' table will be empty and the alert cannot fire.
3
Evaluate secure webhook and action group authentication.
Ensure any Key Vault references used by Azure Monitor Action Groups or related automated webhooks have appropriate access policies.
If the Azure Monitor service principal or the Webhook app's service principal cannot access the Key Vault secret due to a missing access policy, the Action Group will fail to execute actions.

Anahtar Kavram

Log Search Alert Condition and Telemetry Ingestion Configuration
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Implement Azure Monitor Alerts and Action Groups

Bu konudan daha fazla soru