Log Analytics workspace in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does data retention affect a Log Analytics workspace?

In Azure Log Analytics workspace, what happens when you set the data retention period to 30 days?

A Data retention period only affects the dashboard display, not the stored data.

B Data is archived to cold storage after 30 days but remains queryable without extra cost.

C Data older than 30 days is moved to a separate workspace automatically.

D Data older than 30 days is automatically deleted from the workspace.

💡 Hint

Think about how retention policies manage storage costs and data lifecycle.

Setting the data retention period to 30 days means any data older than 30 days is deleted automatically to save storage and cost. It does not archive or move data elsewhere.

❓ Configuration

intermediate

Which configuration enables Azure Monitor to send logs to a Log Analytics workspace?

You want to collect virtual machine logs into a Log Analytics workspace. Which configuration must you enable?

A Create a storage account and link it to the workspace.

B Enable Azure Backup on the virtual machines.

C Install and configure the Azure Monitor agent on the virtual machines.

D Set up a virtual network peering between the VM and workspace.

💡 Hint

Think about how data collection agents work in Azure Monitor.

The Azure Monitor agent collects telemetry and sends logs to the Log Analytics workspace. Backup and storage account are unrelated to log collection. Virtual network peering is not required for this.

❓ Architecture

advanced

Designing a multi-region Log Analytics workspace architecture

You need to design a Log Analytics solution that collects logs from virtual machines in two Azure regions with minimal latency and high availability. Which architecture is best?

A Create a single Log Analytics workspace in one region and configure all VMs to send logs there.

B Create one Log Analytics workspace in each region and configure VMs to send logs to their local workspace.

C Create a Log Analytics workspace in a third region and route logs from both regions there.

D Use Azure Storage accounts in each region to store logs and link them to a workspace.

💡 Hint

Consider latency and availability when choosing workspace locations.

Creating a workspace in each region reduces latency by sending logs locally and improves availability by avoiding a single point of failure. Sending all logs to one region increases latency and risk.

❓ security

advanced

Controlling access to Log Analytics workspace data

Which Azure feature allows you to restrict who can read and query data in a Log Analytics workspace?

A Azure Role-Based Access Control (RBAC) with roles like Log Analytics Reader.

B Azure Policy to enforce workspace data encryption.

C Azure Firewall rules blocking unauthorized IP addresses.

D Network Security Groups (NSGs) applied to the workspace resource.

💡 Hint

Think about how Azure controls user permissions on resources.

Azure RBAC controls user permissions to read and query workspace data. NSGs and Firewall control network traffic but not user permissions. Azure Policy enforces compliance but not direct access control.

✅ Best Practice

expert

Optimizing cost and performance for Log Analytics workspace queries

You notice slow query performance and high costs in your Log Analytics workspace. Which practice will best improve both?

A Use scoped queries with time filters and reduce the amount of data scanned.

B Increase the workspace retention period to keep more data for analysis.

C Run queries more frequently to keep data cached and improve speed.

D Disable data collection from less critical resources to reduce data volume.

💡 Hint

Think about how query scope affects cost and speed.

Scoped queries that filter by time and reduce scanned data improve query speed and lower costs. Increasing retention or running queries more often increases cost. Disabling data collection may reduce data but can lose important info.

Practice

1. What is the main purpose of a Log Analytics workspace in Azure?

easy

A. To provide a user interface for managing Azure subscriptions

B. To host virtual machines and databases

C. To collect and store logs and metrics from cloud resources

D. To create backups of your data automatically

Solution

1. Step 1: Understand the role of Log Analytics workspace

   A Log Analytics workspace is designed to gather and keep logs and metrics from various Azure resources.

2. Step 2: Compare with other Azure services

   Hosting VMs, managing subscriptions, or backups are handled by other Azure services, not Log Analytics workspace.

3. Final Answer:

   To collect and store logs and metrics from cloud resources -> Option C

4. Quick Check:

   Log Analytics workspace = log and metric collection [OK]

Hint: Logs and metrics collection is the key function [OK]

Common Mistakes:

• Confusing Log Analytics workspace with VM hosting
• Thinking it manages subscriptions
• Assuming it handles backups

2. Which of the following is the correct way to specify the retention period when creating a Log Analytics workspace in Azure CLI?

easy

A. --retention 30

B. --retention-time 30

C. --retention-days 30

D. --retention-period 30

Solution

1. Step 1: Recall Azure CLI parameter for retention

   The correct parameter to set retention period in days is --retention-time.

2. Step 2: Verify other options

   Options like --retention, --retention-days, or --retention-period are not valid Azure CLI parameters for this setting.

3. Final Answer:

   --retention-time 30 -> Option B

4. Quick Check:

   Retention period uses --retention-time [OK]

Hint: Retention period uses --retention-time flag [OK]

Common Mistakes:

• Using incorrect parameter names
• Confusing retention-time with retention-days
• Omitting the unit (days)

3. Given the following Azure CLI command to create a Log Analytics workspace, what will be the retention period in days?

az monitor log-analytics workspace create --resource-group MyGroup --workspace-name MyWorkspace --location eastus --retention-time 45

medium

A. 45 days

B. 30 days

C. 90 days

D. Default retention period

Solution

1. Step 1: Identify the retention parameter in the command

   The command uses --retention-time 45, which sets the retention period explicitly to 45 days.

2. Step 2: Understand retention period effect

   This means logs and metrics will be kept for 45 days before automatic deletion.

3. Final Answer:

   45 days -> Option A

4. Quick Check:

   --retention-time 45 means 45 days retention [OK]

Hint: Look for --retention-time value in command [OK]

Common Mistakes:

• Assuming default retention instead of specified
• Confusing retention-time with other parameters
• Ignoring the explicit retention-time flag

4. You tried to create a Log Analytics workspace with this command but got an error:

az monitor log-analytics workspace create --resource-group MyGroup --workspace-name MyWorkspace --location eastus --retention 30

What is the likely cause of the error?

medium

A. The location eastus is not supported

B. The resource group MyGroup does not exist

C. The workspace name is too short

D. The parameter --retention is invalid; it should be --retention-time

Solution

1. Step 1: Check the parameter names in the command

   The command uses --retention, which is not a valid parameter for retention period in Azure CLI.

2. Step 2: Identify the correct parameter

   The correct parameter to specify retention days is --retention-time. Using the wrong parameter causes a syntax error.

3. Final Answer:

   The parameter --retention is invalid; it should be --retention-time -> Option D

4. Quick Check:

   Use --retention-time, not --retention [OK]

Hint: Retention parameter must be --retention-time [OK]

Common Mistakes:

• Using --retention instead of --retention-time
• Assuming location eastus is invalid
• Ignoring resource group existence

5. You want to create a Log Analytics workspace that stores logs for 60 days and is located in the same region as your Azure virtual machines in westus2. Which Azure CLI command correctly achieves this?

hard

A. az monitor log-analytics workspace create --resource-group MyGroup --workspace-name MyWorkspace --location westus2 --retention-time 60

B. az monitor log-analytics workspace create --resource-group MyGroup --workspace-name MyWorkspace --location eastus --retention-time 60

C. az monitor log-analytics workspace create --resource-group MyGroup --workspace-name MyWorkspace --location westus2 --retention 60

D. az monitor log-analytics workspace create --resource-group MyGroup --workspace-name MyWorkspace --location westus2

Solution

1. Step 1: Match location with VM region

   The workspace must be in westus2 to match the VM region.

2. Step 2: Set retention period correctly

   The retention period must be 60 days, so use --retention-time 60.

3. Step 3: Verify command correctness

   The command az monitor log-analytics workspace create --resource-group MyGroup --workspace-name MyWorkspace --location westus2 --retention-time 60 uses the correct location and retention parameter. The command with --location eastus uses wrong location. The command with --retention 60 uses invalid retention parameter. The command without retention omits the period setting.

4. Final Answer:

   az monitor log-analytics workspace create --resource-group MyGroup --workspace-name MyWorkspace --location westus2 --retention-time 60 -> Option A

5. Quick Check:

   Location and retention-time must match requirements [OK]

Hint: Match location and use --retention-time for retention [OK]

Common Mistakes:

• Using wrong location
• Using --retention instead of --retention-time
• Omitting retention period