AZ-305 Question 4
Select 2Contoso runs a multi-tier e-commerce application on Azure App Service with an Azure SQL Database. Their compliance policy requires storing logs for at least three years and the ability to perform advanced queries across all logs. They also want near real-time insight into errors. Which two solutions should you recommend to meet these requirements?
- A
Use Diagnostic Settings to stream all resource logs to a single Log Analytics workspace and set the workspace retention to three years.
- B
Enable Azure Monitor Activity Logs only, relying on them for detailed application logging and long-term storage.
- C
Use Diagnostic Settings to send logs both to an Azure Storage account (for staging long-term archives) and to an Event Hub for near real-time streaming analytics.
- D
Create separate Log Analytics workspaces for each Azure resource, with no retention period set on any workspace.
Show answer and explanation
Correct answers: A, C
Explanation
A recommended approach is to centralize logs in a Log Analytics workspace for unified querying and to configure retention to meet compliance. Additionally, Azure Storage is often used for economical long-term retention, and streaming to Event Hub allows real-time analysis. Refer to Microsoft documentation on Azure Monitor, Diagnostic Settings, and retention policies for best practices: https://learn.microsoft.com/azure/azure-monitor/essentials/diagnostic-settings.
- A. Correct.
Option 1 is correct. Sending all resource logs to a centralized Log Analytics workspace allows unified log collection and enables advanced searches. Log Analytics lets you configure retention up to three years (or more as needed), meeting the compliance requirement.
- B. Incorrect.
Option 2 is incorrect. Azure Monitor Activity Logs provide a record of control-plane events (e.g., resource creation, modification) but do not capture detailed application logs. Relying solely on Activity Logs would miss many essential diagnostics.
- C. Correct.
Option 3 is correct. By using Diagnostic Settings to stream logs to Azure Storage, Contoso can meet the long-term retention requirement at low cost. Simultaneously sending logs to an Event Hub enables near real-time data ingestion into analytics solutions (e.g., Azure Stream Analytics or third-party SIEMs).
- D. Incorrect.
Option 4 is incorrect. While multiple workspaces can be used to segregate environments, creating separate workspaces for every resource without retention policies complicates log management and does not satisfy the requirement of a unified, long-term logging strategy.