Examkin

Soru

Zorluk: ZorMonitoring and Log Routing Solutions

An enterprise is designing a centralized monitoring and log routing architecture for its Azure environment. The architecture must accommodate several workloads with distinct security, compliance, and retention constraints. Match each operational log routing requirement on the left with its most appropriate Azure routing and destination configuration on the right.

  • Administrative actions and management operations executed at the Azure subscription level.A subscription-level diagnostic setting that streams logs to a centralized Log Analytics workspace.
  • Near-real-time application security events that must be streamed to an external, on-premises Security Information and Event Management (SIEM) system.An Azure Event Hubs namespace acting as the destination for diagnostic settings to stream event data.
  • Database query audit logs that must be archived for seven years to meet regulatory compliance at the absolute minimum cost.A centralized Azure Storage account with lifecycle management policies to transition data to the archive tier.
  • Resource-level diagnostic logs from multiple regions that must be analyzed centrally while enforcing access boundaries so team members only view logs for resources they own.A centralized Log Analytics workspace configured to use resource-context Access Control Mode.

Cevap

Administrative actions at the subscription level match to a subscription-level diagnostic setting. Near-real-time SIEM logs match to the Event Hubs namespace. Database audit archives match to the Storage account with archive tier lifecycle policies. Regional diagnostic logs with restricted access match to the centralized Log Analytics workspace with resource-context Access Control Mode.
The correct matches align with Microsoft Azure best practices for log routing: Subscription-level actions go to Log Analytics via subscription-level diagnostic settings for central monitoring. External SIEM streams ingest logs from Azure Event Hubs to avoid polling latency. High-volume, cold-tier retention is routed to Azure Storage with lifecycle policies to minimize costs. Multi-region diagnostic logs are centralized in a single workspace where resource-context RBAC restricts visibility without the need for multiple workspaces.

Adım Adım Çözüm

1
Identify the scope and frequency requirements for each log source.
The workloads span subscription-level auditing, real-time external streaming, long-term cold archiving, and decentralized access with centralized storage.
This establishes the constraints and targets for log routing.
2
Select the most cost-effective and compliant destination for long-term retention.
Azure Storage account with archive tier lifecycle rules is chosen for the 7-year audit logs.
Log Analytics ingestion and retention costs are too high for long-term cold storage.
3
Determine the streaming mechanism for the external SIEM integration.
Azure Event Hubs is mapped to the SIEM requirement.
Event Hubs provides low-latency, real-time ingestion capabilities suited for SIEM ingestion.
4
Determine the optimal workspace configuration for resource access boundaries.
A centralized Log Analytics workspace with resource-context access control is selected.
This configuration allows users to query logs of resources they own without needing access to the workspace, avoiding workspace duplication.

Anahtar Kavram

Designing a centralized log routing architecture in Azure that satisfies ingestion latency, retention costs, and security boundary constraints using Azure Monitor, Log Analytics, Event Hubs, and Storage Accounts.
Bu soruyu puanla

Konular

Monitoring and Log Routing Solutions