AZ-500 Question 134
Select 2You are a security engineer responsible for a microservices application deployed as Azure Container Apps (ACAs). You need to detect and investigate suspicious container activity, such as unauthorized access attempts and anomalies in container behavior. Which two actions should you take to configure comprehensive security monitoring for your ACA environment?
- A
Enable diagnostic settings on your Azure Container Apps and route the logs to a Log Analytics workspace for further analysis.
- B
Deploy the Azure Monitor for containers agent sidecar to each container in Azure Container Apps to collect and forward container logs.
- C
Enable Microsoft Defender for Cloud’s container threat detection capabilities by assigning the relevant plan for your containerized workloads.
- D
Configure a separate Azure Key Vault to store all container application logs in encrypted form.
Show answer and explanation
Correct answers: A, C
Explanation
To monitor security events in Azure Container Apps, you should first enable diagnostic settings to collect logs in a central location such as a Log Analytics workspace. This allows for detailed analysis and custom alerting. Additionally, enabling Microsoft Defender for Cloud’s container plan provides threat detection and security alerts for container workloads. For more information, refer to Microsoft’s documentation on monitoring ACA with Azure Monitor and securing containers with Microsoft Defender for Cloud.
- A. Correct.
Correct. Configuring diagnostic settings on Azure Container Apps and sending logs to a Log Analytics workspace is a recommended approach. This allows you to centralize logs and perform queries and alerts, which is crucial for detecting security anomalies.
- B. Incorrect.
Incorrect. Azure Monitor for containers sidecar agents are primarily designed for Azure Kubernetes Service (AKS) clusters. Azure Container Apps do not require a sidecar agent to stream logs; you enable diagnostics through the ACA platform.
- C. Correct.
Correct. When you enable container threat detection in Microsoft Defender for Cloud and assign the appropriate plan, you gain threat detection and security insights for container workloads, helping you identify suspicious activities and vulnerabilities.
- D. Incorrect.
Incorrect. Azure Key Vault primarily secures secrets (e.g., certificates, keys, passwords). Storing raw container logs directly in Key Vault isn’t a standard or practical method for monitoring or analytics. ACA logs are typically routed to Log Analytics or storage accounts for investigation.