AZ-500 Question 263
Single answerContoso has multiple Windows-based virtual machines (VMs) and an Azure Firewall in their environment. They want to collect both CPU usage metrics from the Windows VMs and network security events from the Azure Firewall logs, consolidating all data into a single Log Analytics workspace named 'SecDataWorkspace' for further analysis and alerting. How should you configure the Data Collection Rule (DCR) in Azure Monitor to achieve these requirements?
- A
Create two separate data collection rules: one for Windows performance counters and one for Azure Firewall logs, each pointing to a different Log Analytics workspace.
- B
Create a single data collection rule that includes both Windows performance counters and Azure Firewall logs as data sources, associate it with the relevant VMs and firewall resource, and set 'SecDataWorkspace' as the destination.
- C
Create a diagnostic setting for performance counters on the Windows VMs and then route the firewall logs to a single DCR, sending all data to 'SecDataWorkspace'.
- D
Use a single data collection rule that only collects network security events and rely on a separate Azure Monitor metrics workspace for Windows performance counters.
Show answer and explanation
Correct answer: B
Explanation
By using a single data collection rule that includes both performance metrics and firewall logs, you reduce complexity and ensure all data is centralised in the same Log Analytics workspace. Azure Monitor DCRs allow you to specify multiple data sources and a shared destination, making them well-suited for collecting and analyzing security events and performance data together. For more details, see Microsoft's documentation on Data Collection Rules: https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview.
- A. Incorrect.
Option 1: Incorrect. While it's technically possible to create two separate data collection rules, splitting them into different workspaces doesn't meet the requirement of consolidating all data in one place. This approach also increases administrative overhead.
- B. Correct.
Option 2: Correct. Azure Monitor DCRs can combine multiple data sources in one rule. By configuring both the Windows performance counters and Azure Firewall logs as inputs and selecting 'SecDataWorkspace' as the destination, all collected data lands in the specified workspace for unified analysis.
- C. Incorrect.
Option 3: Incorrect. A diagnostic setting is a different mechanism from DCR and is typically used to send resource-specific telemetry to destinations. In this scenario, combining performance and firewall data in the same DCR is a simpler approach if they all use the same destination workspace.
- D. Incorrect.
Option 4: Incorrect. Performance counters do not require a separate Azure Monitor metrics workspace. DCRs can handle collecting both performance counters and network security logs together in a single Log Analytics workspace.