AZ-305 Question 10
Select 2Contoso wants to collect logs from virtual machines, web apps, and Azure SQL databases spanning multiple subscriptions to a single Log Analytics workspace for centralized monitoring. They also need to stream these logs to an external SIEM in near real-time. Which two approaches should you recommend?
- A
- Configure Diagnostic Settings for each resource to send logs to a single Log Analytics workspace and an Azure Event Hub.
- B
- Install the Azure Monitor Agent on all virtual machines and specify the single Log Analytics workspace name during setup.
- C
- Use Continuous Export from the Log Analytics workspace to export logs to a Storage account, then pull them into the SIEM on a weekly schedule.
- D
- Build a custom forwarder that copies log files to Azure Files, and configure the SIEM to retrieve them via file shares.
Show answer and explanation
Correct answers: A, B
Explanation
To meet near real-time requirements and centralize log collection, you should leverage Azure Monitor Diagnostic Settings for PaaS services and the Azure Monitor Agent for VMs, sending data to a single Log Analytics workspace. Diagnostic Settings can simultaneously route the same logs to an Event Hub for integration with external SIEM solutions. Refer to Microsoft Documentation (https://learn.microsoft.com/azure/azure-monitor/logs/diagnostic-settings and https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-overview) for best practices and detailed configuration steps.
- A. Correct.
Option 1 is correct. Azure Diagnostic Settings allows you to select multiple endpoints for resource logs. Sending logs to both a single Log Analytics Workspace and Azure Event Hub enables centralized monitoring in Log Analytics while also streaming data to an external SIEM via Event Hub for near real-time ingestion.
- B. Correct.
Option 2 is correct. For virtual machines, installing the Azure Monitor Agent (AMA) and pointing it to the Log Analytics workspace centralizes VM logs and metrics. While diagnostic settings capture PaaS-specific logs, AMA is recommended for collecting guest-level telemetry from virtual machines.
- C. Incorrect.
Option 3 is incorrect. Continuous Export to Storage is no longer the recommended best practice for near real-time log ingestion. Exporting on a weekly schedule introduces unacceptable lag when the requirement is near real-time monitoring.
- D. Incorrect.
Option 4 is incorrect. Manually storing logs on Azure Files and having the SIEM retrieve them is an unnecessarily complex, custom solution. It does not offer the near real-time log streaming or native integration that Diagnostic Settings and Event Hub provide.