AZ-305 Question 6
Select 2A global retailer has deployed multiple Azure services, Azure Virtual Machines, Azure App Service, Azure Key Vault, and Azure SQL Database, across several subscriptions. The security and operations teams require a consistent approach to logging and retaining data for 90 days for regulatory compliance. They also want to run queries from a single location and configure automated alerts in response to suspicious activities. Which two actions should you recommend to implement a centralized, scalable logging solution with minimal overhead?
- A
Create one Log Analytics workspace and configure Diagnostic settings for each resource to send logs to that workspace.
- B
Use separate Azure Monitor workspaces in each subscription to isolate log data and limit cross-subscription reporting.
- C
Export logs to Azure Storage accounts in each region for immediate archival and for all analytics queries.
- D
Configure alerts and queries in Azure Monitor using the shared Log Analytics workspace to streamline investigation across all services.
Show answer and explanation
Correct answers: A, D
Explanation
A common best practice is to aggregate logs from all Azure resources into a single Log Analytics workspace using Diagnostic settings. Azure Monitor seamlessly integrates with this workspace, allowing you to run Kusto-based queries across all logs, retain data for compliance, and configure alerts. According to Microsoft documentation, consolidating logs in one workspace simplifies management and provides a unified view for both operations and security teams.
- A. Correct.
Option 1 is correct. Creating a single Log Analytics workspace and configuring Diagnostic settings for each resource to route logs there consolidates logs in one place, making it easier to run queries, set retention policies, and maintain compliance with minimal complexity. This approach is a recommended best practice when a unified logging and query experience is needed.
- B. Incorrect.
Option 2 is incorrect. Using separate Azure Monitor workspaces in each subscription can fragment the logging data, requiring multiple queries across different workspaces. This raises complexity and overhead, contradicting the requirement for a single location and minimal management effort.
- C. Incorrect.
Option 3 is incorrect. While exporting logs to Azure Storage can be useful for archival, it does not provide analytic capabilities like Kusto queries (used by Azure Monitor Logs) or straightforward alerting features. This approach adds extra steps for ingestion, reducing efficiency in active monitoring and investigation.
- D. Correct.
Option 4 is correct. Once logs are in a single Log Analytics workspace, you can configure Azure Monitor alerts and queries to detect anomalies and suspicious activities across all services within one solution. This centralized approach simplifies administrative overhead and enables immediate incident response.