AZ-305 Question 9
Select 2You are designing a unified logging strategy for a global ecommerce platform hosted on Azure. The platform includes Azure App Service, Azure Kubernetes Service (AKS), and Azure SQL Database. The organization requires near real-time monitoring and alerting, long-term storage of logs for compliance, and integration with a third-party SIEM solution for advanced threat detection. Which two approaches should you implement to meet these requirements?
- A
Configure diagnostic settings on each resource to export logs to an Azure Storage account for long-term retention and compliance requirements.
- B
Configure diagnostic settings on each resource and route logs both to an Azure Log Analytics workspace for near real-time insight and to an Event Hub for the third-party SIEM.
- C
Forward logs from each resource using Azure Service Bus queues to integrate with Azure Monitor for analytics and alerts.
- D
Enable a built-in mechanism in Azure Monitor to automatically push logs from all resources directly to the third-party SIEM without configuration.
Show answer and explanation
Correct answers: A, B
Explanation
To meet both security and compliance requirements, it is best practice to send logs to multiple destinations. Azure Storage (for archival and compliance) and an Azure Log Analytics workspace (for near real-time analysis) are commonly used together. For integration with a third-party SIEM, Azure Event Hubs is the recommended routing service. Refer to Microsoft's documentation on Azure Monitor diagnostic settings (https://learn.microsoft.com/azure/azure-monitor/essentials/diagnostic-settings) for detailed guidance on configuring log routing.
- A. Correct.
Correct. Storing logs in an Azure Storage account addresses compliance requirements by allowing for long-term retention. This approach does not directly provide analytics, but it secures logs for future references and audits.
- B. Correct.
Correct. Sending logs to a Log Analytics workspace enables near real-time analysis, querying, and alerting. Routing logs to an Event Hub allows seamless integration with a third-party SIEM for deeper security insights and centralized monitoring.
- C. Incorrect.
Incorrect. Azure Service Bus is not typically used for high-volume log ingestion scenarios. Azure Event Hubs is the recommended service for streaming logs to external solutions or SIEM platforms because it is designed for large-scale, real-time data ingestion.
- D. Incorrect.
Incorrect. While Azure Monitor can collect and analyze logs, there is no out-of-the-box setting that automatically ships logs from all your Azure resources directly to a third-party SIEM without configuring diagnostic settings or using Event Hubs.