AZ-104 Question 252
Select 2Your company requires you to retain Azure Storage account logs for 60 days in a Log Analytics workspace, while also forwarding logs in real-time to an external SIEM solution. Which configuration steps should you take when creating a diagnostic setting in Azure Monitor to meet these requirements?
- A
Enable diagnostics and select 'Send to Log Analytics workspace' with a 60-day retention period
- B
Disable the 'Archive to storage account' option to prevent any conflict with third-party solutions
- C
Enable 'Send to Event Hub' in the same diagnostic setting to forward logs to the SIEM
- D
Configure the Log Analytics workspace with a 31-day retention policy and rely on an external backup for extended retention
Show answer and explanation
Correct answers: A, C
Explanation
By configuring the diagnostic setting to send logs to Log Analytics with 60-day retention and also sending them to an Event Hub, you satisfy both the audit/storage requirement and real-time forwarding to the external SIEM. Adjusting the storage account archiving or using a shorter Log Analytics retention policy would not meet the 60-day retention need.
- A. Correct.
This correctly sets diagnostic logs to be sent to a Log Analytics workspace and configures the needed 60-day retention.
- B. Incorrect.
While you can disable archiving to storage, it is not required to fulfill the SIEM and retention requirements.
- C. Correct.
Enabling 'Send to Event Hub' allows real-time forwarding of logs to your external SIEM for analysis.
- D. Incorrect.
A 31-day retention policy does not meet the 60-day requirement, making this option unsuitable.