Hotspot Question You have an Azure subscription. The subscription contains 100 virtual machines that run Windows Server 2022 and have the Azure Monitor Agent installed. You need to recommend a solutio

Question

Exhibit

Answer Area

• To forward the logs:
  A linked storage account for the Log Analytics workspaceAn Azure Monitor data collection endpointA service endpoint
• To transform the logs and store the data:
  A KQL queryA WQL queryAn XPath query

Explanation

This question tests knowledge of Azure Monitor Agent data collection components used to ingest, transform, and store custom JSON logs from virtual machines into a Log Analytics workspace.

Approach. To forward JSON-formatted logs from VMs to a Log Analytics workspace, you need a Data Collection Endpoint (DCE) - it acts as the ingestion point that receives log data sent by the Azure Monitor Agent. To transform the logs and store them in a specific table, you need a Data Collection Rule (DCR) with a transformation query - the DCR defines what data to collect, applies KQL-based transformations via the ingestion-time transformation feature, and routes the data to the appropriate Log Analytics workspace table (such as a custom table). The custom table in the Log Analytics workspace must be created with the appropriate schema to store the transformed data. Together, DCE + DCR with transformation covers both requirements: forwarding JSON logs and transforming/storing them.

Concept tested. Azure Monitor Agent data pipeline: Data Collection Endpoints (DCE) for log ingestion, Data Collection Rules (DCR) with ingestion-time KQL transformations, and custom Log Analytics workspace tables for storing transformed JSON log data.

Reference. https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-rule-overview

No community discussion yet for this question.