Log Analytics workspace in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does data retention affect a Log Analytics workspace?

In Azure Log Analytics workspace, what happens when you set the data retention period to 30 days?

A Data retention period only affects the dashboard display, not the stored data.

B Data is archived to cold storage after 30 days but remains queryable without extra cost.

C Data older than 30 days is moved to a separate workspace automatically.

D Data older than 30 days is automatically deleted from the workspace.

💡 Hint

Think about how retention policies manage storage costs and data lifecycle.

Setting the data retention period to 30 days means any data older than 30 days is deleted automatically to save storage and cost. It does not archive or move data elsewhere.

❓ Configuration

intermediate

Which configuration enables Azure Monitor to send logs to a Log Analytics workspace?

You want to collect virtual machine logs into a Log Analytics workspace. Which configuration must you enable?

A Create a storage account and link it to the workspace.

B Enable Azure Backup on the virtual machines.

C Install and configure the Azure Monitor agent on the virtual machines.

D Set up a virtual network peering between the VM and workspace.

💡 Hint

Think about how data collection agents work in Azure Monitor.

The Azure Monitor agent collects telemetry and sends logs to the Log Analytics workspace. Backup and storage account are unrelated to log collection. Virtual network peering is not required for this.

❓ Architecture

advanced

Designing a multi-region Log Analytics workspace architecture

You need to design a Log Analytics solution that collects logs from virtual machines in two Azure regions with minimal latency and high availability. Which architecture is best?

A Create a single Log Analytics workspace in one region and configure all VMs to send logs there.

B Create one Log Analytics workspace in each region and configure VMs to send logs to their local workspace.

C Create a Log Analytics workspace in a third region and route logs from both regions there.

D Use Azure Storage accounts in each region to store logs and link them to a workspace.

💡 Hint

Consider latency and availability when choosing workspace locations.

Creating a workspace in each region reduces latency by sending logs locally and improves availability by avoiding a single point of failure. Sending all logs to one region increases latency and risk.

❓ security

advanced

Controlling access to Log Analytics workspace data

Which Azure feature allows you to restrict who can read and query data in a Log Analytics workspace?

A Azure Role-Based Access Control (RBAC) with roles like Log Analytics Reader.

B Azure Policy to enforce workspace data encryption.

C Azure Firewall rules blocking unauthorized IP addresses.

D Network Security Groups (NSGs) applied to the workspace resource.

💡 Hint

Think about how Azure controls user permissions on resources.

Azure RBAC controls user permissions to read and query workspace data. NSGs and Firewall control network traffic but not user permissions. Azure Policy enforces compliance but not direct access control.

✅ Best Practice

expert

Optimizing cost and performance for Log Analytics workspace queries

You notice slow query performance and high costs in your Log Analytics workspace. Which practice will best improve both?

A Use scoped queries with time filters and reduce the amount of data scanned.

B Increase the workspace retention period to keep more data for analysis.

C Run queries more frequently to keep data cached and improve speed.

D Disable data collection from less critical resources to reduce data volume.

💡 Hint

Think about how query scope affects cost and speed.

Scoped queries that filter by time and reduce scanned data improve query speed and lower costs. Increasing retention or running queries more often increases cost. Disabling data collection may reduce data but can lose important info.