Examkin

Soru

Zorluk: OrtaMonitoring and Log Routing Solutions

An educational technology provider is designing a monitoring and audit log routing architecture for its multi-tenant platform. You need to match each workload telemetry source or monitoring requirement to its most appropriate Azure destination or storage configuration to optimize cost, performance, and capability.

  • Microsoft Entra ID sign-in logs that must be sent to an external, third-party SIEM systemAzure Event Hubs
  • Virtual machine boot diagnostics screenshots and serial logs that are rarely accessedAzure Storage account
  • Subscription-level deployment and management events that must be kept for 90 days at zero extra costAzure Activity Log default store
  • Container performance metrics and console logs that require complex correlation using Kusto Query Language (KQL)Azure Log Analytics workspace

Cevap

The correct matches are: Microsoft Entra ID sign-in logs match with Azure Event Hubs; Virtual machine boot diagnostics match with Azure Storage account; Subscription-level events match with Azure Activity Log default store; Container logs requiring KQL match with Azure Log Analytics workspace.
The solution correctly pairs each monitoring telemetry source with the destination that matches its functional and cost constraints. Third-party SIEM integration is achieved via Azure Event Hubs. Boot diagnostics utilize Azure Storage for cost-effective unstructured storage. Activity logs are kept in their default store for 90 days for free. Container logs requiring complex queries are routed to a Log Analytics workspace.

Adım Adım Çözüm

1
Analyze the real-time external integration requirement.
Streaming logs to a third-party SIEM requires a message ingestion service, making Azure Event Hubs the correct choice.
Azure Event Hubs serves as the standard pipeline for forwarding log data to non-Azure monitoring systems.
2
Determine the lowest-cost option for boot diagnostics.
Boot diagnostics consist of screenshots and serial console text, which are stored as unstructured files in an Azure Storage account.
Using a Log Analytics workspace for boot diagnostics would incur unnecessary ingestion and retention costs.
3
Evaluate the subscription audit log retention constraint.
The Azure Activity Log platform store keeps the last 90 days of management events free of charge.
Since the requirement is 90 days of history at zero extra cost, routing them to another workspace or storage account is unnecessary.
4
Identify the target for KQL querying and metrics analytics.
A Log Analytics workspace is required to run KQL queries.
KQL is the query language for Azure Monitor Logs stored within Log Analytics workspaces.

Anahtar Kavram

Selecting log routing destinations based on query, cost, retention, and integration requirements.
Bu soruyu puanla

Konular

Monitoring and Log Routing Solutions