AZ-500 Question 262
Single answerYou are responsible for collecting and analyzing network security event logs from multiple Linux-based Azure VMs. You decide to configure a Data Collection Rule (DCR) in Azure Monitor to gather Syslog data from these VMs and send it to a Log Analytics workspace for robust querying and alerting. Which of the following tasks is a required step to successfully configure the DCR so it collects Syslog data from the Linux VMs?
- A
Define a new DCR with Syslog as the data source, scope it to the resource group containing the Linux VMs, and configure the Log Analytics workspace as the destination. Then deploy the Azure Monitor Agent extension on each VM.
- B
Define a new DCR, specify Windows event logs from each VM, and configure an Azure Storage account as the destination. Then enable diagnostics at the subscription level.
- C
Enable Network Security Group (NSG) Flow Logs at the NSG level, create a separate DCR to collect flow logs, and specify 'None' as the data source. Then deploy the Azure Monitor Agent to the Linux VMs.
- D
Create a new DCR with Performance Counters only, scope it to multiple subscriptions, and select an existing Log Analytics workspace as the destination. No extension deployment is required.
Show answer and explanation
Correct answer: A
Explanation
When configuring Data Collection Rules (DCRs) for Linux VMs in Azure Monitor, you must specify the correct data source (e.g., Syslog) and scope (e.g., a resource group, subscription, or individual VMs). You also need to configure where the data will be sent (e.g., a Log Analytics workspace). Finally, ensure that the Azure Monitor Agent (AMA) is installed on each target VM so the DCR can collect and forward the specified data. Refer to Microsoft Doc's 'Create and manage data collection rules in Azure Monitor' (https://learn.microsoft.com/azure/azure-monitor/agents/data-collection-rule-overview) for additional details.
- A. Correct.
Correct. To gather Syslog data from Linux VMs using a Data Collection Rule, you need to define 'Syslog' as the data source, scope the rule to the relevant resource (for example, the resource group containing the VMs), and specify your Log Analytics workspace as the destination. Finally, you must ensure the Azure Monitor Agent extension is deployed on each Linux VM so the Syslog data can be collected and forwarded.
- B. Incorrect.
Incorrect. Windows event logs are not applicable to Linux VMs, and sending data to Azure Storage via a DCR is not the standard approach for Syslog data. This option also references enabling diagnostics at the subscription level, which is insufficient and does not satisfy the Syslog requirement for Linux VMs.
- C. Incorrect.
Incorrect. NSG Flow Logs are a separate feature and not directly configured via a Syslog-based DCR. Specifying 'None' as the data source means no Syslog data will be collected. While NSG Flow Logs can provide network traffic insights, they do not replace Syslog collection on Linux VMs.
- D. Incorrect.
Incorrect. Only collecting Performance Counters does not include network security event logs (Syslog). Additionally, the Azure Monitor Agent must be deployed for the DCR to collect and send data. Simply creating a DCR without deploying the agent on the VMs will not result in any captured data.