AZ-104 Question #593: Real Exam Question with Answer & Explanation

Question

Hotspot Question You have an Azure subscription that contains the resources shown in the following table. You plan to create a data collection rule named DCR1 in Azure Monitor. Which resources can you set as data sources in DCR1, and which resources can you set as destinations in DCR1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Options

• __typehotspot
• variantyes_no

Explanation

The correct interaction is to select 'VM1 only' as data sources and 'Workspace1 only' as destinations, as Data Collection Rules (DCRs) with Azure Monitor Agent primarily collect data from virtual machines and send it to Log Analytics workspaces for analysis.

Approach. To correctly answer this hotspot question, we must understand which of the listed Azure resources can function as data sources for a Data Collection Rule (DCR) and which can serve as destinations.

Data Sources Selection:

• VM1 (Virtual machine): Virtual machines are primary targets for the Azure Monitor Agent (AMA). DCRs are used to define what guest operating system data (performance counters, event logs, syslog, custom logs) the AMA collects from VMs. Therefore, VM1 is a valid data source.
• storage1 (Storage account): Storage accounts are typically destinations for diagnostic settings or used to store raw data, but a DCR does not directly 'collect' data from a storage account in the context of agent-based monitoring. It is not a source for AMA.
• Workspace1 (Log Analytics workspace): A Log Analytics workspace is a destination where collected data is stored and analyzed, not a source for data collection itself.
• DB1 (Azure SQL database): Azure SQL Databases use diagnostic settings to send their logs and metrics to other services (like Log Analytics workspaces, Event Hubs, or storage accounts). They are not configured as a direct data source for agent-based collection via a DCR in this manner. Based on this analysis, 'VM1 only' is the correct selection for data sources.

Destinations Selection:

• Workspace1 (Log Analytics workspace): This is the most common and primary destination for data collected by DCRs from the Azure Monitor Agent. It enables advanced querying, analytics, alerting, and visualization within Azure Monitor. Thus, Workspace1 is a valid and central destination.
• storage1 (Storage account): DCRs can send certain types of logs (e.g., custom text logs, IIS logs, Syslog, Windows Event logs) to Azure Storage accounts, typically for archival or integration with other systems. While technically a possible destination for some logs, in the context of general VM monitoring data where comprehensive analytics are expected, Log Analytics is the primary service.
• DB1 (Azure SQL database): Azure SQL Databases are not supported destinations for data collected directly by a DCR. DCRs primarily send data to Log Analytics workspaces, Azure Storage, Event Hubs, and Azure Monitor Metrics.

Given that the question asks to select the 'appropriate options' and the provided correct solution highlights 'Workspace1 only' for destinations, it indicates that for general VM monitoring data via DCRs, Log Analytics workspace is considered the primary and most appropriate analytical destination within Azure Monitor.

Common mistakes.

• common_mistake. Common mistakes include selecting storage accounts or Azure SQL databases as data sources, as DCRs primarily collect agent-based data from compute resources like VMs. Also, incorrectly including Azure SQL databases as a destination is wrong, as they are not supported by DCRs for receiving collected data. While storage accounts can be a destination for certain log types, selecting 'Workspace1 only' as the destination emphasizes the primary analytical function of a Log Analytics workspace for VM monitoring data collected via DCRs, as opposed to storage's archival role or specific log forwarding.

Concept tested. The core concept tested is the understanding of Azure Monitor Data Collection Rules (DCRs), their role with the Azure Monitor Agent (AMA), and the specific types of Azure resources that can function as supported data sources and destinations for monitoring data within Azure Monitor.

No community discussion yet for this question.