Azure Monitoring and Logging Design Flashcards

You need to stream Azure Monitor logs in near-real-time to Microsoft Sentinel for SIEM analysis. Which Azure service is the recommended streaming pipeline?

Answer: Azure Event Hubs

Azure Event Hubs is the recommended high-throughput streaming pipeline for exporting Azure Monitor logs to external systems like Microsoft Sentinel and third-party SIEMs.

A Log Analytics workspace is retaining large volumes of historical log data for compliance purposes, causing high costs. What is the most cost-effective way to retain this data long-term?

Answer: Use the Log Analytics archive tier for long-term low-cost retention

The Log Analytics archive tier retains data beyond the interactive period at significantly lower cost, meeting compliance requirements while eliminating the need to query archived data frequently.

You need to automatically scale a Virtual Machine Scale Set based on a custom business metric published to Azure Monitor from your application. Which service manages this autoscale logic?

Answer: Azure Monitor autoscale

Azure Monitor autoscale supports scaling rules based on any metric available in Azure Monitor, including custom metrics published by applications, enabling business-driven scaling decisions.

Your team needs to run a single query to find all Azure storage accounts missing soft delete protection across 20 subscriptions. Which service is best suited for this?

Answer: Azure Resource Graph

Azure Resource Graph enables fast, complex queries over Azure resource properties and configurations across multiple subscriptions at scale, making it ideal for compliance inventory checks.

You need to ensure that diagnostic data sent from on-premises-connected VMs to a Log Analytics workspace does not traverse the public internet. Which Azure feature should you implement?

Answer: Azure Private Link for Azure Monitor (AMPLS)

Azure Monitor Private Link Scope (AMPLS) uses Azure Private Link to connect your virtual network to Azure Monitor endpoints via private endpoints, keeping all monitoring traffic off the public internet.

You need to provide stakeholders with personalized recommendations to reduce Azure spending, improve reliability, and address security vulnerabilities without building custom queries. Which service should you use?

Answer: Azure Advisor

Azure Advisor analyzes your resource configurations and usage telemetry to provide prioritized, actionable recommendations across cost, reliability, security, performance, and operational excellence.

Your organization needs a cloud-native SIEM solution with built-in SOAR capabilities to detect threats, investigate incidents, and automate responses across Azure and hybrid environments. Which Microsoft service should you deploy?

Answer: Microsoft Sentinel

Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR platform, providing AI-driven threat detection, investigation with hunting queries, and automated playbook-based response across hybrid environments.