AZ-500 Question 264
Select 1Your organization manages multiple Azure Firewall instances in separate production resource groups across two subscriptions. The security team wants to collect network security event logs from all these Firewalls into a single Log Analytics workspace for centralized threat analysis. The team also wants to ensure that any newly added Azure Firewall in those production resource groups is automatically included without further manual configuration. Which two actions should you perform when creating the data collection rule (DCR) to meet these requirements? (Choose two)
- A
Scope the data collection rule to the specific resource groups that contain the production Azure Firewalls, and configure the rule to automatically include any Azure Firewall resources in those groups.
- B
Set data filtering in the DCR to include only the relevant event categories (e.g., AzureFirewallNetworkRule, AzureFirewallApplicationRule) before sending logs to the Log Analytics workspace.
- C
Individually select each Azure Firewall resource ID to ensure accuracy and prevent accidental log collection from non-production resources.
- D
Use a transformation in the DCR to tag each incoming log record with 'Prod-Firewall' so new Firewalls can be discovered automatically in the workspace.
Show answer and explanation
Correct answer: A
Explanation
In Azure Monitor, data collection rules (DCRs) define how and where to collect data, including logs from Azure Firewall. Scoping the DCR to the appropriate resource groups and setting up event category filtering allows you to capture only relevant network security events from Azure Firewalls without manual updates. This approach meets the real-world requirement of automatically including new Firewall instances. For more details, see the official Microsoft documentation on DCR configuration at https://learn.microsoft.com/azure/azure-monitor/essentials/data-collection-rule-overview.
- A. Correct.
Option 1 is correct. By scoping the DCR to the production resource groups that host Azure Firewalls, you ensure that any new Firewall in those groups is automatically captured without manually adding each resource.
- B. Incorrect.
Option 2 is correct. Configuring filtering in the DCR lets you capture only relevant security event logs (e.g., network or application rule logs), thereby reducing unnecessary data ingestion and focusing on the logs needed for threat analysis.
- C. Incorrect.
Option 3 is incorrect. Selecting each Firewall resource individually requires manual updates whenever a new Firewall is added, which contradicts the requirement for automatic inclusion of new Firewalls in production resource groups.
- D. Incorrect.
Option 4 is incorrect. While transformations can add tags to logs, it does not automatically discover new Firewalls. Scoping the DCR to the resource group does that. Transformations primarily help with customizing log fields, not resource discovery.