Diagnostic settings for resources in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Identify the correct diagnostic setting configuration to send logs to a Log Analytics workspace

Which of the following JSON snippets correctly configures diagnostic settings for an Azure resource to send logs and metrics to a Log Analytics workspace?

A

{
  "properties": {
    "workspaceId": "/subscriptions/xxxx/resourceGroups/rg1/providers/Microsoft.OperationalInsights/workspaces/logAnalytics1",
    "logs": [
      { "category": "AuditLogs", "enabled": true }
    ],
    "metrics": [
      { "category": "AllMetrics", "enabled": true }
    ]
  }
}

B

{
  "properties": {
    "logAnalyticsWorkspaceId": "/subscriptions/xxxx/resourceGroups/rg1/providers/Microsoft.OperationalInsights/workspaces/logAnalytics1",
    "logs": [
      { "category": "AuditLogs", "enabled": true }
    ],
    "metrics": [
      { "category": "AllMetrics", "enabled": true }
    ]
  }
}

C

{
  "properties": {
    "workspaceId": "/subscriptions/xxxx/resourceGroups/rg1/providers/Microsoft.OperationalInsights/workspaces/logAnalytics1",
    "logs": [
      { "category": "AuditLogs", "enabled": false }
    ],
    "metrics": [
      { "category": "AllMetrics", "enabled": true }
    ]
  }
}

D

}
}  
]    
} eurt :"delbane" ,"scirteMllA" :"yrogetac" {      
[ :"scirtem"    
,]    
} eurt :"delbane" ,"sgoLtiduA" :"yrogetac" {      
[ :"sgol"    
,"1scitylanAgol/secapskrow/sthgisnIlanoitarepO.tfosorciM/sredivorp/1gr/spuorGecruoser/xxxx/snoitpircsbus/" :"dIecapskrow"    
{ :"seitreporp"  
{

💡 Hint

Look for the correct property name for the Log Analytics workspace and ensure logs are enabled.

The correct property to specify the Log Analytics workspace is 'workspaceId'. Logs must have 'enabled' set to true to be collected. Option A correctly sets these properties.

❓ service_behavior

intermediate

Effect of missing retention policy in diagnostic settings

What happens if you configure diagnostic settings for an Azure resource without specifying a retention policy for logs?

A Logs are automatically deleted after 30 days by default.

B Logs are retained for 90 days by default.

C Logs are retained indefinitely until manually deleted.

D Logs are not collected at all without a retention policy.

💡 Hint

Think about default behavior when retention is not set.

If no retention policy is set, logs are kept indefinitely in the destination until manually deleted or the resource is deleted.

❓ security

advanced

Securing diagnostic settings data flow

Which configuration ensures that diagnostic logs sent from an Azure resource to a storage account are encrypted and access is restricted?

A Disable encryption but restrict access with firewall rules to trusted IPs only.

B Use a public storage account with no encryption and allow all networks to access it.

C Use customer-managed keys without network restrictions on the storage account.

D Enable storage account encryption with Microsoft-managed keys and configure a private endpoint for the storage account.

💡 Hint

Consider both encryption and network access controls.

Option D ensures data is encrypted at rest using Microsoft-managed keys and restricts access via private endpoint, enhancing security.

❓ Architecture

advanced

Designing diagnostic settings for multi-region resource monitoring

You have resources deployed in multiple Azure regions. What is the best approach to centralize diagnostic logs for monitoring and analysis?

A Create separate Log Analytics workspaces in each region and keep logs isolated per region.

B Configure each resource to send diagnostic logs to a single Log Analytics workspace in one region.

C Send logs to storage accounts in each region without central aggregation.

D Use Event Hubs to stream logs to an on-premises SIEM system only.

💡 Hint

Think about ease of analysis and cost efficiency.

Centralizing logs in one Log Analytics workspace simplifies monitoring and reduces management overhead.

🧠 Conceptual

expert

Understanding diagnostic settings limits and impact

What is the maximum number of diagnostic settings you can configure per Azure resource, and what happens if you exceed this limit?

A You can configure up to 5 diagnostic settings per resource; attempts to add more will fail with a quota error.

B There is no limit on diagnostic settings per resource; Azure automatically manages scaling.

C You can configure up to 10 diagnostic settings per resource; exceeding this causes logs to be dropped silently.

D Only 1 diagnostic setting is allowed per resource; additional settings overwrite the existing one.

💡 Hint

Check Azure resource limits documentation for diagnostic settings.

Azure limits diagnostic settings to 5 per resource. Trying to add more results in an error preventing creation.