Azure Monitoring and Logging Design Flashcards

You need to centralize log collection from multiple Azure subscriptions for cross-subscription analysis. Which Azure resource should you deploy?

Answer: Log Analytics workspace

A Log Analytics workspace is the central repository for collecting, storing, and querying log data from multiple Azure resources and subscriptions using KQL.

You need an alert that fires when CPU utilization on a VM exceeds 80% for five consecutive minutes. Which Azure Monitor alert type should you use?

Answer: Metric alert

Metric alerts evaluate numeric resource metrics at regular intervals and trigger when a threshold is crossed, making them ideal for CPU utilization monitoring.

An application team wants to track user sessions, page load times, and unhandled exceptions for their Azure-hosted web app. Which service best meets this requirement?

Answer: Azure Application Insights

Azure Application Insights is an APM service built for web applications, providing end-to-end tracing, user behavior analytics, performance monitoring, and exception tracking.

You need to ensure that diagnostic settings are automatically configured on all newly created Azure resources to forward logs to a Log Analytics workspace. Which approach should you implement?

Answer: Azure Policy with deployIfNotExists effect

Azure Policy with the deployIfNotExists effect automatically deploys diagnostic settings to compliant resources, including newly created ones, without manual intervention.

Your organization needs to receive SMS and email notifications when an Azure regional outage affects resources in your subscription. Which service should you configure?

Answer: Azure Service Health alerts

Azure Service Health provides personalized alerts for Azure platform issues, planned maintenance, and health advisories affecting your specific resources and subscriptions.

What is the default interactive data retention period for a Log Analytics workspace before data must be archived or deleted?

Answer: 90 days

The default interactive retention period for a Log Analytics workspace is 90 days; data can be extended up to 730 days for interactive use or archived at lower cost beyond that.

You want to reuse the same set of email, SMS, and webhook notifications across multiple alert rules. Which Azure Monitor feature enables this?

Answer: Action groups

Action groups are reusable collections of notification and action preferences (email, SMS, webhook, ITSM, etc.) that can be referenced by multiple alert rules.