AZ-305 Question 7
Single answerA company runs multiple applications hosted on Azure Virtual Machines and Azure Web Apps. They want to centralize logs from each service in a single location for near real-time monitoring, querying, and alerting. They also have a requirement for at least 30 days of log retention. Which logging solution should you recommend?
- A
Configure diagnostic settings on each resource and send logs to a single Azure Storage account.
- B
Use Azure Monitor with a Log Analytics workspace for centralized data ingestion and analysis.
- C
Enable only the Azure Activity Log and export it to Azure Storage for retention.
- D
Create a custom logging pipeline using on-premises servers that forward logs to Azure Data Explorer.
Show answer and explanation
Correct answer: B
Explanation
Azure Monitor with a Log Analytics workspace provides a unified approach to collecting, analyzing, and acting on logs from Azure resources. It simplifies retention, supports near real-time queries using Kusto Query Language (KQL), and integrates seamlessly with alerting. For more details, see the official documentation: https://learn.microsoft.com/azure/azure-monitor/.
- A. Incorrect.
Option 1 is incorrect. While Azure Storage can be used to store diagnostic logs, it is best suited for archival rather than near real-time analysis. This solution lacks built-in alerting and advanced query capabilities without additional services.
- B. Correct.
Option 2 is correct. Azure Monitor with a Log Analytics workspace provides near real-time monitoring, built-in query support, alerting, and straightforward scalability. It meets the data retention requirement and is the recommended approach for centralizing activity, diagnostics, and metrics logs from Azure resources.
- C. Incorrect.
Option 3 is incorrect. The Azure Activity Log captures only control-plane events. It does not include the resource-level or application-level logs needed for detailed troubleshooting and monitoring. Storing just the Activity Log in Azure Storage does not satisfy the requirement for analyzing all logs in one place.
- D. Incorrect.
Option 4 is incorrect. Building a fully custom pipeline on-premises introduces unnecessary complexity, network overhead, and potential latency. While Azure Data Explorer is a powerful analytics platform, combining Azure Monitor and a Log Analytics workspace is the standard, more efficient solution for centralizing and managing logs.