AZ-305 Question 5
Select 2A technology solutions company runs a microservices-based application on Azure using a Virtual Machine Scale Set for the front-end, several Azure Functions for serverless workflows, and Azure Key Vault for secrets management. They need a unified, long-term logging solution that can consolidate logs from these resources, provide advanced query capabilities, and retain logs for one year. They also want to capture Azure Activity Logs at the subscription level. Which two actions should they take to meet these requirements?
- A
Deploy separate Log Analytics workspaces for the Virtual Machine Scale Set and Azure Functions with the default 31-day retention policy
- B
Create a single Log Analytics workspace, configure diagnostic settings on each resource to send logs to that workspace, and extend retention to 365 days
- C
Enable boot diagnostics on the Virtual Machine Scale Set to automatically forward logs to local storage for each instance
- D
Configure subscription-level diagnostic settings to route Azure Activity Logs to the same Log Analytics workspace
- E
Keep all logs in an Azure Storage account with a lifecycle management policy for indefinite retention
Show answer and explanation
Correct answers: B, D
Explanation
Combining a single Log Analytics workspace with diagnostic settings on each resource and at the subscription level is considered a best practice. It consolidates all logs in one location, facilitates cross-resource correlation and analytics, and meets extended retention requirements. For more details, refer to the official Azure Monitor and Azure Diagnostics documentation, which outlines how to set up centralized logging and configure retention policies.
- A. Incorrect.
Option 1 is incorrect. Deploying separate Log Analytics workspaces typically complicates log correlation and doesn’t meet the company’s goal of a single consolidated solution. Additionally, the default 31-day retention is insufficient for the required one-year retention.
- B. Correct.
Option 2 is correct. Creating a single Log Analytics workspace and configuring diagnostic settings for each resource enables centralized management and provides advanced querying capabilities. Extending Log Analytics retention to 365 days meets long-term retention requirements.
- C. Incorrect.
Option 3 is incorrect. Boot diagnostics to local storage mainly helps capture console output and screenshots for troubleshooting. It is not a comprehensive logging solution and does not meet the centralization or retention requirements.
- D. Correct.
Option 4 is correct. Subscription-level diagnostic settings ensure Azure Activity Logs are directed to the same Log Analytics workspace, including security and operational events needed for compliance and investigations.
- E. Incorrect.
Option 5 is incorrect. Storing logs directly in Azure Storage without sending them to a Log Analytics workspace limits advanced querying and analytics features. While Azure Storage may help with raw retention, it doesn’t fulfill the requirement of centralized correlation and rich querying.