AZ-104 Question 255
Select 2You manage a multi-subscription Azure environment hosting a distributed containerized application. You need to query and analyze logs from containers running in different subscriptions within a single consolidated view using Azure Monitor. Which two actions should you take to achieve this goal?
- A
Enable Azure Security Center at the subscription level to collect container logs
- B
Configure each container’s diagnostics to send logs to the same Log Analytics workspace
- C
Disable cross-subscription queries to simplify data ingestion
- D
Use Kusto Query Language’s cross-resource queries with the union operator to reference multiple Log Analytics workspaces
Show answer and explanation
Correct answers: B, D
Explanation
To analyze logs from multiple Azure subscriptions in one location, you should configure each container to send logs to a common Log Analytics workspace and then leverage KQL cross-resource queries (for example, using the union operator) to gather and analyze data. This approach ensures all container logs are accessible and can be correlated in a single query, offering a unified view across all subscriptions.
- A. Incorrect.
Although Azure Security Center can provide security-related data, it does not consolidate all container logs for analytical queries in Azure Monitor.
- B. Correct.
Configuring each container to send its logs to the same Log Analytics workspace ensures all data is available in one place for querying and analysis.
- C. Incorrect.
Disabling cross-subscription queries prevents the ability to analyze logs from multiple Azure subscriptions in a single query, which is counterproductive to the scenario’s goal.
- D. Correct.
Using cross-resource queries with the union operator in Kusto Query Language (KQL) allows retrieving logs from multiple Log Analytics workspaces across different subscriptions in a single query.