AZ-500 · Question #201
You have an Azure Active Directory (Azure AD) tenant named contoso.com. You need to configure diagnostic settings for contoso.com. The solution must meet the following requirements: - Retain logs…
The correct answer is B. an Azure Log Analytics workspace. To retain Azure AD diagnostic logs for two years and enable Kusto query language for analysis, an Azure Log Analytics workspace is the most suitable storage destination.
Question
Options
- Aan Azure event hub
- Ban Azure Log Analytics workspace
- Can Azure Storage account
How the community answered
(40 responses)- A5% (2)
- B85% (34)
- C10% (4)
Why each option
To retain Azure AD diagnostic logs for two years and enable Kusto query language for analysis, an Azure Log Analytics workspace is the most suitable storage destination.
An Azure event hub is primarily for streaming data in real-time to other services and does not provide built-in long-term storage or Kusto query capabilities.
An Azure Log Analytics workspace is specifically designed for collecting, storing, and analyzing logs from various Azure services, including Azure AD, offering robust Kusto Query Language (KQL) capabilities. It supports long-term data retention, easily exceeding the two-year requirement, and centralizes log management, minimizing administrative overhead.
An Azure Storage account can retain logs for long periods, but it does not natively support querying data using Kusto Query Language (KQL) without integrating with additional services.
Concept tested: Azure AD diagnostic settings destinations
Source: https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/tutorial-configure-diagnostics-storage
Topics
Community Discussion
No community discussion yet for this question.