AZ-305 Question 2
Single answerYou are migrating a multi-region application consisting of Azure Kubernetes Service (AKS) containers, Azure Functions, and Azure Virtual Machines. The operations team requires a centralized logging solution across all components with at least 30 days of log retention and the ability to query logs for troubleshooting. They also need alert rules for performance anomalies. Which design approach best meets these requirements in a cost-effective manner?
- A
Deploy a single Azure Monitor Log Analytics workspace in a central region, connect all resources to it for log ingestion, configure performance alerts, and set retention to 30 days.
- B
Use local logs on each VM, enable Application Insights for Azure Functions, and rely on AKS default logging. Forward all logs to an on-premises SIEM through Event Grid.
- C
Leverage Azure Storage for raw log files from each resource, parse them using a custom Azure Function for anomalies, and rely solely on Activity Log alerts for notifications.
- D
Create separate Azure Monitor Log Analytics workspaces per resource type, manage log retention individually, and set up different alert rules in each workspace.
Show answer and explanation
Correct answer: A
Explanation
A single Azure Monitor Log Analytics workspace is a recommended best practice for collecting logs across multiple Azure resources like VMs, Functions, and containers. It enables unified querying, centralized retention settings, and straightforward alert configuration. By consolidating logs into one workspace, you reduce complexity and streamline troubleshooting. This approach is documented in Azure Monitor best practices and the official Microsoft documentation: https://learn.microsoft.com/azure/azure-monitor/.
- A. Correct.
Correct. A single Azure Monitor Log Analytics workspace provides a centralized portal for collecting and analyzing logs, setting consistent retention, and creating alerts. This approach simplifies management, optimizes cost, and meets the requirement for cross-resource troubleshooting.
- B. Incorrect.
Incorrect. Although local logs and individual service-based logging can capture events, scattering logs across multiple collection points complicates correlation, query, and alert configuration. An on-premises SIEM could be used, but it adds overhead and isn’t necessarily the most cost-effective.
- C. Incorrect.
Incorrect. Storing raw logs in Azure Storage and manually parsing them with Azure Functions is complex and prone to missing real-time alerts. Activity Log alerts alone offer limited insight into specific resource performance issues.
- D. Incorrect.
Incorrect. Deploying multiple workspaces increases management overhead, makes cross-resource troubleshooting more difficult, and may drive up costs. A separate workspace per resource type hinders a unified view of performance and anomalous behavior.