AZ-305 Azure Monitoring and Logging Design 2 — Questions and Answers
Question 1: You need to query Azure Monitor logs to identify all failed authentication events on your VMs over the past 24 hours. Which query language should you use?
- T-SQL
- PowerShell DSL
- Kusto Query Language (KQL) (Correct answer)
- GraphQL
Correct answer: Kusto Query Language (KQL)
Kusto Query Language (KQL) is the native query language for Azure Monitor Log Analytics, designed for fast exploration and analysis of large log datasets.
Question 2: You need to create interactive, shareable visual reports that combine Azure Monitor metrics, logs, and Azure Resource Graph data in a single view. Which feature should you use?
- Azure Monitor dashboards
- Azure Monitor workbooks (Correct answer)
- Power BI Embedded reports
- Azure Metrics Explorer
Correct answer: Azure Monitor workbooks
Azure Monitor workbooks provide a flexible, interactive canvas that can combine data from multiple sources—metrics, logs, Azure Resource Graph—into parameterized reports for sharing.
Question 3: You need to monitor node health, pod resource usage, and container logs for an AKS cluster using Azure Monitor. Which solution should you enable?
- Azure Monitor for VMs
- Azure Monitor for Networks
- Container insights (Correct answer)
- Application Insights SDK
Correct answer: Container insights
Container insights (formerly Azure Monitor for containers) provides performance and health monitoring specifically for AKS nodes, pods, and containers, collecting metrics and logs automatically.
Question 4: You need to capture network packet-level traffic to and from a VM's NIC for forensic security analysis. Which Azure Network Watcher feature should you use?
- Connection monitor
- NSG flow logs
- Packet capture (Correct answer)
- IP flow verify
Correct answer: Packet capture
Packet capture in Azure Network Watcher records raw network packets to and from a VM's NIC, stored in Azure Storage or the VM's disk for detailed forensic analysis.
Question 5: Your security team needs to determine who made changes to Azure resources, when those changes occurred, and from which IP address. Which log source should they query?
- Azure Diagnostics logs (resource logs)
- Azure Activity Log (Correct answer)
- Application Insights request telemetry
- VM performance counters
Correct answer: Azure Activity Log
The Azure Activity Log records all control-plane operations on Azure resources, capturing the caller identity, source IP, timestamp, and operation outcome for governance and auditing.
Question 6: You need to collect VM performance metrics and logs using a modern, centrally managed agent that supports Data Collection Rules (DCRs). Which agent should you deploy?
- Microsoft Monitoring Agent (MMA)
- OMS agent for Linux
- Azure Monitor Agent (AMA) (Correct answer)
- Windows Diagnostics extension (WAD)
Correct answer: Azure Monitor Agent (AMA)
The Azure Monitor Agent (AMA) is the modern unified agent that replaces MMA and OMS agents, supporting Data Collection Rules for flexible, centrally managed data collection from VMs.
Question 7: You need to diagnose why two Azure VMs cannot communicate with each other despite being in the same VNet. Which Azure Network Watcher tool should you use first?
- Traffic Analytics
- Packet capture
- IP flow verify
- Connection troubleshoot (Correct answer)
Correct answer: Connection troubleshoot
Connection troubleshoot in Azure Network Watcher tests end-to-end connectivity between two endpoints and identifies blocking rules, routing issues, or agent problems preventing communication.
AZ-305 Azure Monitoring and Logging Design 2
You need to query Azure Monitor logs to identify all failed authentication events on your VMs over the past 24 hours.
Which query language should you use?