AZ-305 Question 1
Select 2Your organization manages workloads across multiple Azure subscriptions for different business units. They plan to centralize their monitoring data, such as metrics, activity logs, and resource diagnostic logs, in a single location to enable advanced analytics and custom alert configuration. You need to design a solution that ensures minimal duplication of data, reduces management overhead, and supports real-time insights across all workloads. Which two approaches should you include in your design? (Select two.)
- A
A. Create a single Azure Monitor Log Analytics workspace in one subscription, and configure Diagnostic Settings at both subscription and resource levels to forward logs and metrics to that workspace.
- B
B. Deploy a dedicated Log Analytics workspace in each subscription, then manually aggregate logs by exporting to a shared storage account whenever analysis is required.
- C
C. Enable the Azure Monitor agent or Log Analytics agent on each VM and container, directing their logs and metrics to the centralized Log Analytics workspace for consolidated analysis.
- D
D. Disable the default retention in Azure Monitor and rely solely on storing logs in Azure Storage for long-term archival and on-demand analysis.
Show answer and explanation
Correct answers: A, C
Explanation
By creating a single Log Analytics workspace and enabling the Azure Monitor agent or Log Analytics agent on each resource, you ensure a cloud-wide, centralized repository for advanced analytics, alerting, and dashboard creation. This approach aligns with Azure Monitor best practices highlighted in Microsoft’s documentation (https://learn.microsoft.com/azure/azure-monitor/overview) and significantly reduces management overhead compared to maintaining multiple workspaces or relying on storage accounts for primary logging.
- A. Correct.
A. Correct. Creating a single Log Analytics workspace and configuring Diagnostic Settings for each subscription and resource ensures logs, activity data, and metrics flow into one centralized workspace. This approach simplifies management and enables a unified view in Azure Monitor without creating multiple workspaces or duplicating data.
- B. Incorrect.
B. Incorrect. Although separate workspaces per subscription might initially seem organized, it introduces unnecessary complexity and duplicates effort when you need to query logs across the environment. Manual aggregation in a storage account also hampers real-time analysis and alerting.
- C. Correct.
C. Correct. Installing the Azure Monitor agent or Log Analytics agent on virtual machines and containers and pointing them to the same centralized workspace is a recommended best practice. This configures a consistent workflow for data collection and real-time analysis in Azure Monitor.
- D. Incorrect.
D. Incorrect. Disabling Azure Monitor’s default retention and relying solely on storage accounts complicates real-time monitoring and alerting. This might save on ingestion costs but undermines the ability to quickly correlate and analyze operational data for insights.