Azure Monitoring and Logging Design Flashcards

You need to query Azure Monitor logs to identify all failed authentication events on your VMs over the past 24 hours. Which query language should you use?

Answer: Kusto Query Language (KQL)

Kusto Query Language (KQL) is the native query language for Azure Monitor Log Analytics, designed for fast exploration and analysis of large log datasets.

You need to create interactive, shareable visual reports that combine Azure Monitor metrics, logs, and Azure Resource Graph data in a single view. Which feature should you use?

Answer: Azure Monitor workbooks

Azure Monitor workbooks provide a flexible, interactive canvas that can combine data from multiple sources—metrics, logs, Azure Resource Graph—into parameterized reports for sharing.

You need to monitor node health, pod resource usage, and container logs for an AKS cluster using Azure Monitor. Which solution should you enable?

Answer: Container insights

Container insights (formerly Azure Monitor for containers) provides performance and health monitoring specifically for AKS nodes, pods, and containers, collecting metrics and logs automatically.

You need to capture network packet-level traffic to and from a VM's NIC for forensic security analysis. Which Azure Network Watcher feature should you use?

Answer: Packet capture

Packet capture in Azure Network Watcher records raw network packets to and from a VM's NIC, stored in Azure Storage or the VM's disk for detailed forensic analysis.

Your security team needs to determine who made changes to Azure resources, when those changes occurred, and from which IP address. Which log source should they query?

Answer: Azure Activity Log

The Azure Activity Log records all control-plane operations on Azure resources, capturing the caller identity, source IP, timestamp, and operation outcome for governance and auditing.

You need to collect VM performance metrics and logs using a modern, centrally managed agent that supports Data Collection Rules (DCRs). Which agent should you deploy?

Answer: Azure Monitor Agent (AMA)

The Azure Monitor Agent (AMA) is the modern unified agent that replaces MMA and OMS agents, supporting Data Collection Rules for flexible, centrally managed data collection from VMs.

You need to diagnose why two Azure VMs cannot communicate with each other despite being in the same VNet. Which Azure Network Watcher tool should you use first?

Answer: Connection troubleshoot

Connection troubleshoot in Azure Network Watcher tests end-to-end connectivity between two endpoints and identifies blocking rules, routing issues, or agent problems preventing communication.