AZ-500 Question 133
Single answerYou are deploying a microservices solution using Azure Container Apps to host multiple workloads. Your organization wants to detect suspicious container behavior, analyze application logs, track performance metrics, and quickly respond to security threats across these workloads. Which approach should you use to achieve advanced threat detection and centralized log analysis for Azure Container Apps?
- A
Enable Azure Monitor logs on your Container Apps environment, forward logs to a Log Analytics workspace, and enable Microsoft Defender for Cloud coverage for containers.
- B
Rely solely on Azure Policy to perform real-time anomaly detection of container workloads in Azure Container Apps.
- C
Deploy the container workloads to on-premises hosts and configure an external SIEM tool for all threat detection and logging.
- D
Use Azure Container Registry’s scanning features to catch both runtime threats and application performance issues in real time.
Show answer and explanation
Correct answer: A
Explanation
Configuring security monitoring for Azure Container Apps involves enabling diagnostic logs and metrics through Azure Monitor while routing these logs to a Log Analytics workspace for analysis. Adding Microsoft Defender for Cloud coverage for containers provides advanced security intelligence and threat detection, which is crucial for identifying suspicious activity at runtime. Refer to Microsoft’s official documentation for Azure Container Apps and Microsoft Defender for Cloud on containers for complete guidance.
- A. Correct.
Option 1 is correct because combining Azure Monitor logs with a Log Analytics workspace captures all relevant data (logs, metrics) in one place for analysis. Enabling Microsoft Defender for Cloud’s container coverage adds advanced threat detection, ensuring suspicious container activity is surfaced. This end-to-end approach is aligned with Microsoft’s recommended best practices for monitoring security in Azure Container Apps.
- B. Incorrect.
Option 2 is incorrect because Azure Policy is primarily used for enforcing governance and compliance rules. It does not provide real-time monitoring or advanced threat detection specifically for container workloads, which Microsoft Defender for Cloud covers.
- C. Incorrect.
Option 3 is incorrect because migrating to on-premises orchestrators negates the benefits of a fully managed Azure Container Apps platform. While a third-party SIEM could analyze logs, it wouldn’t provide the native integrations and automated threat detection available within Azure.
- D. Incorrect.
Option 4 is incorrect because Azure Container Registry scans container images for vulnerabilities pre-deployment, but it does not provide runtime security monitoring or performance-based insights. Runtime monitoring requires additional services like Azure Monitor and Microsoft Defender for Cloud.