Examkin

Soru

Zorluk: KolayMonitoring and Log Routing Solutions

A cloud architecture team is implementing a monitoring strategy for a set of new Azure workloads. The team needs to configure diagnostic settings to satisfy two compliance conditions:

1. Stream resource logs immediately to an external Security Information and Event Management (SIEM) platform.
2. Retain all log data for five years in a secure archive at the lowest possible cost.

Which two Azure destinations should be selected in the diagnostic settings to meet these requirements? (Select TWO)

  1. An Azure Event Hubs namespace and event hubCevap
  2. An Azure Storage accountCevap
  3. C
    A centralized Log Analytics workspace configured for all regional resource groups
  4. D
    An Azure Policy definition using the Deny effect to automate resource remediation
  5. E
    Individual Monitoring Reader role assignments for each administrative user account

Cevap

An Azure Event Hubs namespace and event hub, and an Azure Storage account
To satisfy both requirements, you must route diagnostic logs to two distinct destinations in the diagnostic settings. First, sending logs to an Azure Event Hub allows for near-real-time streaming to external SIEM systems. Second, routing logs to an Azure Storage account provides a low-cost, long-term storage solution for compliance auditing.

Adım Adım Çözüm

1
Analyze the real-time SIEM integration requirement.
Identify that Azure Event Hubs is the correct integration point for streaming data to external, third-party SIEM platforms.
Event Hubs provides near-real-time message ingestion, which is required for external SIEM connectivity.
2
Analyze the long-term, low-cost storage requirement.
Identify that an Azure Storage account offers the lowest-cost option for log data retention over a five-year period.
Compared to Log Analytics, Storage account retention costs are significantly lower for cold, archived logs.
3
Evaluate and eliminate incorrect architectural configurations.
Discard options suggesting Deny policies for remediation, individual RBAC assignments, and centralized workspaces that bypass residency/cost constraints.
These alternatives violate operational, governance, and cost efficiency guidelines.

Anahtar Kavram

Log routing destinations in Azure Monitor diagnostic settings
Bu soruyu puanla

Konular

Monitoring and Log Routing Solutions