Microsoft AZ-305 Azure Monitor Logging Architecture Practice Test

 

Topic 01 focuses on Azure Monitor Logging Architecture and Log Routing for the Microsoft Certified: Azure Solutions Architect Expert certification and the AZ-305 exam, using Microsoft Azure solution-architecture scenarios. For broader exam preparation, review the Microsoft Azure Solutions Architect Expert AZ-305 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

To retain logs for audit or compliance when interactive querying is not the primary need, which Azure design option should be selected?

1. Log Analytics workspace transformation
2. Azure Storage account
3. Azure Activity Log
4. Azure Monitor diagnostic settings

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure Storage account can receive archived platform logs from diagnostic settings for low-cost long-term retention. It directly meets the requirement to retain logs for audit or compliance when interactive querying is not the primary need.

Incorrect Answers

Answer A is incorrect because Log Analytics workspace transformation is used to reduce or reshape ingested log data before storage and query processing; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Azure Activity Log is used to audit management operations performed against Azure resources; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure Monitor diagnostic settings are used to send resource telemetry to the destinations required for analysis, streaming, or retention; that does not directly satisfy the requirement in this scenario.

 

Question 2

Audit logs must be retained for long periods, and analysts will retrieve them only occasionally rather than run routine interactive queries. Which destination best matches this retention requirement?

1. Azure Storage account
2. Azure Monitor diagnostic settings
3. Log Analytics workspace transformation
4. Azure Activity Log

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure Storage account is designed to retain logs for audit or compliance when interactive querying is not the primary need. Azure Storage account can receive archived platform logs from diagnostic settings for low-cost long-term retention.

Incorrect Answers

Answer B is incorrect because Azure Monitor diagnostic settings can be useful in Azure architectures, but its primary role is to send resource telemetry to the destinations required for analysis, streaming, or retention; it is not the best match for the stated priority.

Answer C is incorrect because Log Analytics workspace transformation can be useful in Azure architectures, but its primary role is to reduce or reshape ingested log data before storage and query processing; it is not the best match for the stated priority.

Answer D is incorrect because Azure Activity Log can be useful in Azure architectures, but its primary role is to audit management operations performed against Azure resources; it is not the best match for the stated priority.

 

Question 3

To send resource telemetry to the destinations required for analysis, streaming, or retention, which Azure design option should be selected?

1. Log Analytics workspace
2. Azure Storage account
3. Azure Monitor diagnostic settings
4. Data Collection Rule (DCR)

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure Monitor diagnostic settings are designed to send resource telemetry to the destinations required for analysis, streaming, or retention. Azure Monitor diagnostic settings route supported platform logs and metrics from Azure resources to one or more destinations such as Log Analytics, Event Hubs, or Storage.

Incorrect Answers

Answer A is incorrect because Log Analytics workspace can be useful in Azure architectures, but its primary role is to centralize searchable operational log data for analysis and correlation; it is not the best match for the stated priority.

Answer B is incorrect because Azure Storage account can be useful in Azure architectures, but its primary role is to retain logs for audit or compliance when interactive querying is not the primary need; it is not the best match for the stated priority.

Answer D is incorrect because Data Collection Rule (DCR) can be useful in Azure architectures, but its primary role is to standardize and centrally control guest telemetry collection and routing; it is not the best match for the stated priority.

 

Question 4

To centralize searchable operational log data for analysis and correlation, which Azure design option should be selected?

1. Azure Event Hubs
2. Azure Monitor Agent
3. Azure Activity Log
4. Log Analytics workspace

Correct Answer: D

 

Correct Answer

Answer D is correct because Log Analytics workspace is designed to centralize searchable operational log data for analysis and correlation. Log Analytics workspace stores Azure Monitor Logs data and supports Kusto Query Language queries, alerting, workbooks, and cross-resource analysis.

Incorrect Answers

Answer A is incorrect because Azure Event Hubs can be useful in Azure architectures, but its primary role is to stream Azure telemetry to external analytics or security platforms at scale; it is not the best match for the stated priority.

Answer B is incorrect because Azure Monitor Agent can be useful in Azure architectures, but its primary role is to collect guest OS logs and performance data using the current Azure monitoring agent; it is not the best match for the stated priority.

Answer C is incorrect because Azure Activity Log can be useful in Azure architectures, but its primary role is to audit management operations performed against Azure resources; it is not the best match for the stated priority.

 

Question 5

An Azure resource must send supported platform logs to both an analytics destination and a retention destination. Which resource-level configuration routes this telemetry?

1. Data Collection Rule (DCR)
2. Azure Storage account
3. Azure Monitor diagnostic settings
4. Log Analytics workspace

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure Monitor diagnostic settings route supported platform logs and metrics from Azure resources to one or more destinations such as Log Analytics, Event Hubs, or Storage. It directly meets the requirement to send resource telemetry to the destinations required for analysis, streaming, or retention.

Incorrect Answers

Answer A is incorrect because Data Collection Rule (DCR) is used to standardize and centrally control guest telemetry collection and routing; that does not directly satisfy the requirement in this scenario.

Answer B is incorrect because Azure Storage account is used to retain logs for audit or compliance when interactive querying is not the primary need; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Log Analytics workspace is used to centralize searchable operational log data for analysis and correlation; that does not directly satisfy the requirement in this scenario.

 

Question 6

Which Azure capability provides a high-throughput event ingestion service that can receive routed platform logs for downstream SIEM or custom processing?

1. Azure Storage account
2. Azure Monitor Logs
3. Resource logs
4. Azure Event Hubs

Correct Answer: D

 

Correct Answer

Answer D is correct because Azure Event Hubs matches the described capability and is intended to stream Azure telemetry to external analytics or security platforms at scale.

Incorrect Answers

Answer A is incorrect because Azure Storage account is intended to retain logs for audit or compliance when interactive querying is not the primary need, which is a different architectural function.

Answer B is incorrect because Azure Monitor Logs is intended to investigate and correlate operational events using KQL, which is a different architectural function.

Answer C is incorrect because Resource logs is intended to capture detailed service-level events beyond subscription control-plane activity, which is a different architectural function.

 

Question 7

Operations staff need a shared place to query and correlate operational logs collected from several Azure resources. Which component should hold the searchable log data?

1. Azure Monitor Agent
2. Azure Event Hubs
3. Log Analytics workspace
4. Azure Activity Log

Correct Answer: C

 

Correct Answer

Answer C is correct because Log Analytics workspace stores Azure Monitor Logs data and supports Kusto Query Language queries, alerting, workbooks, and cross-resource analysis. It directly meets the requirement to centralize searchable operational log data for analysis and correlation.

Incorrect Answers

Answer A is incorrect because Azure Monitor Agent is used to collect guest OS logs and performance data using the current Azure monitoring agent; that does not directly satisfy the requirement in this scenario.

Answer B is incorrect because Azure Event Hubs is used to stream Azure telemetry to external analytics or security platforms at scale; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure Activity Log is used to audit management operations performed against Azure resources; that does not directly satisfy the requirement in this scenario.

 

Question 8

For Resource logs, which statement is accurate?

1. Can filter or transform supported incoming data before it is stored in a Log Analytics workspace.
2. Provide service-specific operational events emitted by an Azure resource and can be routed with diagnostic settings.
3. Route supported platform logs and metrics from Azure resources to one or more destinations such as Log Analytics, Event Hubs, or Storage.
4. Collects guest operating system telemetry from supported machines and sends it according to Data Collection Rules.

Correct Answer: B

 

Correct Answer

Answer B is correct because Resource logs provide service-specific operational events emitted by an Azure resource and can be routed with diagnostic settings.

Incorrect Answers

Answer A is incorrect because that description belongs to Log Analytics workspace transformation, whose purpose is to reduce or reshape ingested log data before storage and query processing.

Answer C is incorrect because that description belongs to Azure Monitor diagnostic settings, whose purpose is to send resource telemetry to the destinations required for analysis, streaming, or retention.

Answer D is incorrect because that description belongs to Azure Monitor Agent, whose purpose is to collect guest OS logs and performance data using the current Azure monitoring agent.

 

Question 9

For Azure Monitor Logs, which statement is accurate?

1. Provides centralized log query and analysis across data stored in Log Analytics workspaces.
2. Collects guest operating system telemetry from supported machines and sends it according to Data Collection Rules.
3. Provides a high-throughput event ingestion service that can receive routed platform logs for downstream SIEM or custom processing.
4. Route supported platform logs and metrics from Azure resources to one or more destinations such as Log Analytics, Event Hubs, or Storage.

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure Monitor Logs provides centralized log query and analysis across data stored in Log Analytics workspaces.

Incorrect Answers

Answer B is incorrect because that description belongs to Azure Monitor Agent, whose purpose is to collect guest OS logs and performance data using the current Azure monitoring agent.

Answer C is incorrect because that description belongs to Azure Event Hubs, whose purpose is to stream Azure telemetry to external analytics or security platforms at scale.

Answer D is incorrect because that description belongs to Azure Monitor diagnostic settings, whose purpose is to send resource telemetry to the destinations required for analysis, streaming, or retention.

 

Question 10

When considering Azure Monitor diagnostic settings, which requirement supports that choice?

1. To centralize searchable operational log data for analysis and correlation.
2. To send resource telemetry to the destinations required for analysis, streaming, or retention.
3. To retain logs for audit or compliance when interactive querying is not the primary need.
4. To standardize and centrally control guest telemetry collection and routing.

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure Monitor diagnostic settings route supported platform logs and metrics from Azure resources to one or more destinations such as Log Analytics, Event Hubs, or Storage.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Log Analytics workspace, not Azure Monitor diagnostic settings.

Answer C is incorrect because that outcome is more directly associated with Azure Storage account, not Azure Monitor diagnostic settings.

Answer D is incorrect because that outcome is more directly associated with Data Collection Rule (DCR), not Azure Monitor diagnostic settings.

 

Question 11

To reduce or reshape ingested log data before storage and query processing, which Azure design option should be selected?

1. Azure Monitor Logs
2. Log Analytics workspace
3. Log Analytics workspace transformation
4. Data Collection Rule (DCR)

Correct Answer: C

 

Correct Answer

Answer C is correct because Log Analytics workspace transformation is designed to reduce or reshape ingested log data before storage and query processing. Log Analytics workspace transformation can filter or transform supported incoming data before it is stored in a Log Analytics workspace.

Incorrect Answers

Answer A is incorrect because Azure Monitor Logs can be useful in Azure architectures, but its primary role is to investigate and correlate operational events using KQL; it is not the best match for the stated priority.

Answer B is incorrect because Log Analytics workspace can be useful in Azure architectures, but its primary role is to centralize searchable operational log data for analysis and correlation; it is not the best match for the stated priority.

Answer D is incorrect because Data Collection Rule (DCR) can be useful in Azure architectures, but its primary role is to standardize and centrally control guest telemetry collection and routing; it is not the best match for the stated priority.

 

Question 12

Which Azure capability collects guest operating system telemetry from supported machines and sends it according to Data Collection Rules?

1. Azure Monitor Agent
2. Resource logs
3. Azure Storage account
4. Data Collection Rule (DCR)

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure Monitor Agent matches the described capability and is intended to collect guest OS logs and performance data using the current Azure monitoring agent.

Incorrect Answers

Answer B is incorrect because Resource logs is intended to capture detailed service-level events beyond subscription control-plane activity, which is a different architectural function.

Answer C is incorrect because Azure Storage account is intended to retain logs for audit or compliance when interactive querying is not the primary need, which is a different architectural function.

Answer D is incorrect because Data Collection Rule (DCR) is intended to standardize and centrally control guest telemetry collection and routing, which is a different architectural function.

 

Question 13

When considering Azure Monitor Agent, which requirement supports that choice?

1. To standardize and centrally control guest telemetry collection and routing.
2. To retain logs for audit or compliance when interactive querying is not the primary need.
3. To capture detailed service-level events beyond subscription control-plane activity.
4. To collect guest OS logs and performance data using the current Azure monitoring agent.

Correct Answer: D

 

Correct Answer

Answer D is correct because Azure Monitor Agent collects guest operating system telemetry from supported machines and sends it according to Data Collection Rules.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Data Collection Rule (DCR), not Azure Monitor Agent.

Answer B is incorrect because that outcome is more directly associated with Azure Storage account, not Azure Monitor Agent.

Answer C is incorrect because that outcome is more directly associated with Resource logs, not Azure Monitor Agent.

 

Question 14

For Log Analytics workspace transformation, which statement is accurate?

1. Defines what telemetry Azure Monitor Agent collects, how it is transformed, and where it is sent.
2. Can filter or transform supported incoming data before it is stored in a Log Analytics workspace.
3. Provides centralized log query and analysis across data stored in Log Analytics workspaces.
4. Stores Azure Monitor Logs data and supports Kusto Query Language queries, alerting, workbooks, and cross-resource analysis.

Correct Answer: B

 

Correct Answer

Answer B is correct because Log Analytics workspace transformation can filter or transform supported incoming data before it is stored in a Log Analytics workspace.

Incorrect Answers

Answer A is incorrect because that description belongs to Data Collection Rule (DCR), whose purpose is to standardize and centrally control guest telemetry collection and routing.

Answer C is incorrect because that description belongs to Azure Monitor Logs, whose purpose is to investigate and correlate operational events using KQL.

Answer D is incorrect because that description belongs to Log Analytics workspace, whose purpose is to centralize searchable operational log data for analysis and correlation.

 

Question 15

To standardize and centrally control guest telemetry collection and routing, which Azure design option should be selected?

1. Azure Event Hubs
2. Log Analytics workspace transformation
3. Azure Activity Log
4. Data Collection Rule (DCR)

Correct Answer: D

 

Correct Answer

Answer D is correct because Data Collection Rule (DCR) is designed to standardize and centrally control guest telemetry collection and routing. Data Collection Rule (DCR) defines what telemetry Azure Monitor Agent collects, how it is transformed, and where it is sent.

Incorrect Answers

Answer A is incorrect because Azure Event Hubs can be useful in Azure architectures, but its primary role is to stream Azure telemetry to external analytics or security platforms at scale; it is not the best match for the stated priority.

Answer B is incorrect because Log Analytics workspace transformation can be useful in Azure architectures, but its primary role is to reduce or reshape ingested log data before storage and query processing; it is not the best match for the stated priority.

Answer C is incorrect because Azure Activity Log can be useful in Azure architectures, but its primary role is to audit management operations performed against Azure resources; it is not the best match for the stated priority.

 

Question 16

When considering Azure Monitor Logs, which requirement supports that choice?

1. To investigate and correlate operational events using KQL.
2. To stream Azure telemetry to external analytics or security platforms at scale.
3. To collect guest OS logs and performance data using the current Azure monitoring agent.
4. To send resource telemetry to the destinations required for analysis, streaming, or retention.

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure Monitor Logs provides centralized log query and analysis across data stored in Log Analytics workspaces.

Incorrect Answers

Answer B is incorrect because that outcome is more directly associated with Azure Event Hubs, not Azure Monitor Logs.

Answer C is incorrect because that outcome is more directly associated with Azure Monitor Agent, not Azure Monitor Logs.

Answer D is incorrect because that outcome is more directly associated with Azure Monitor diagnostic settings, not Azure Monitor Logs.

 

Question 17

Which Azure capability records subscription-level control-plane events such as resource creation, deletion, and configuration changes?

1. Azure Monitor Logs
2. Log Analytics workspace
3. Azure Activity Log
4. Resource logs

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure Activity Log matches the described capability and is intended to audit management operations performed against Azure resources.

Incorrect Answers

Answer A is incorrect because Azure Monitor Logs is intended to investigate and correlate operational events using KQL, which is a different architectural function.

Answer B is incorrect because Log Analytics workspace is intended to centralize searchable operational log data for analysis and correlation, which is a different architectural function.

Answer D is incorrect because Resource logs is intended to capture detailed service-level events beyond subscription control-plane activity, which is a different architectural function.

 

Question 18

An organization wants to collect guest OS logs and performance data using the current Azure monitoring agent. Which design choice most directly meets the requirement?

1. Data Collection Rule (DCR)
2. Azure Monitor Agent
3. Resource logs
4. Azure Storage account

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure Monitor Agent collects guest operating system telemetry from supported machines and sends it according to Data Collection Rules. It directly meets the requirement to collect guest OS logs and performance data using the current Azure monitoring agent.

Incorrect Answers

Answer A is incorrect because Data Collection Rule (DCR) is used to standardize and centrally control guest telemetry collection and routing; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Resource logs is used to capture detailed service-level events beyond subscription control-plane activity; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure Storage account is used to retain logs for audit or compliance when interactive querying is not the primary need; that does not directly satisfy the requirement in this scenario.

 

Question 19

For Log Analytics workspace, which statement is accurate?

1. Provides a high-throughput event ingestion service that can receive routed platform logs for downstream SIEM or custom processing.
2. Stores Azure Monitor Logs data and supports Kusto Query Language queries, alerting, workbooks, and cross-resource analysis.
3. Records subscription-level control-plane events such as resource creation, deletion, and configuration changes.
4. Collects guest operating system telemetry from supported machines and sends it according to Data Collection Rules.

Correct Answer: B

 

Correct Answer

Answer B is correct because Log Analytics workspace stores Azure Monitor Logs data and supports Kusto Query Language queries, alerting, workbooks, and cross-resource analysis.

Incorrect Answers

Answer A is incorrect because that description belongs to Azure Event Hubs, whose purpose is to stream Azure telemetry to external analytics or security platforms at scale.

Answer C is incorrect because that description belongs to Azure Activity Log, whose purpose is to audit management operations performed against Azure resources.

Answer D is incorrect because that description belongs to Azure Monitor Agent, whose purpose is to collect guest OS logs and performance data using the current Azure monitoring agent.

 

Question 20

Which Azure capability can filter or transform supported incoming data before it is stored in a Log Analytics workspace?

1. Log Analytics workspace
2. Azure Monitor Logs
3. Log Analytics workspace transformation
4. Data Collection Rule (DCR)

Correct Answer: C

 

Correct Answer

Answer C is correct because Log Analytics workspace transformation matches the described capability and is intended to reduce or reshape ingested log data before storage and query processing.

Incorrect Answers

Answer A is incorrect because Log Analytics workspace is intended to centralize searchable operational log data for analysis and correlation, which is a different architectural function.

Answer B is incorrect because Azure Monitor Logs is intended to investigate and correlate operational events using KQL, which is a different architectural function.

Answer D is incorrect because Data Collection Rule (DCR) is intended to standardize and centrally control guest telemetry collection and routing, which is a different architectural function.

 

Question 21

A SIEM integration must receive a continuous high-throughput stream of Azure platform logs. Which statement correctly describes the Azure service designed for this ingestion pattern?

1. Provides a high-throughput event ingestion service that can receive routed platform logs for downstream SIEM or custom processing.
2. Provide service-specific operational events emitted by an Azure resource and can be routed with diagnostic settings.
3. Provides centralized log query and analysis across data stored in Log Analytics workspaces.
4. Can receive archived platform logs from diagnostic settings for low-cost long-term retention.

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure Event Hubs provides a high-throughput event ingestion service that can receive routed platform logs for downstream SIEM or custom processing.

Incorrect Answers

Answer B is incorrect because that description belongs to Resource logs, whose purpose is to capture detailed service-level events beyond subscription control-plane activity.

Answer C is incorrect because that description belongs to Azure Monitor Logs, whose purpose is to investigate and correlate operational events using KQL.

Answer D is incorrect because that description belongs to Azure Storage account, whose purpose is to retain logs for audit or compliance when interactive querying is not the primary need.

 

Question 22

Which Azure capability defines what telemetry Azure Monitor Agent collects, how it is transformed, and where it is sent?

1. Azure Event Hubs
2. Log Analytics workspace transformation
3. Azure Activity Log
4. Data Collection Rule (DCR)

Correct Answer: D

 

Correct Answer

Answer D is correct because Data Collection Rule (DCR) matches the described capability and is intended to standardize and centrally control guest telemetry collection and routing.

Incorrect Answers

Answer A is incorrect because Azure Event Hubs is intended to stream Azure telemetry to external analytics or security platforms at scale, which is a different architectural function.

Answer B is incorrect because Log Analytics workspace transformation is intended to reduce or reshape ingested log data before storage and query processing, which is a different architectural function.

Answer C is incorrect because Azure Activity Log is intended to audit management operations performed against Azure resources, which is a different architectural function.

 

Question 23

To stream Azure telemetry to external analytics or security platforms at scale, which Azure design option should be selected?

1. Azure Storage account
2. Azure Monitor Logs
3. Resource logs
4. Azure Event Hubs

Correct Answer: D

 

Correct Answer

Answer D is correct because Azure Event Hubs is designed to stream Azure telemetry to external analytics or security platforms at scale. Azure Event Hubs provides a high-throughput event ingestion service that can receive routed platform logs for downstream SIEM or custom processing.

Incorrect Answers

Answer A is incorrect because Azure Storage account can be useful in Azure architectures, but its primary role is to retain logs for audit or compliance when interactive querying is not the primary need; it is not the best match for the stated priority.

Answer B is incorrect because Azure Monitor Logs can be useful in Azure architectures, but its primary role is to investigate and correlate operational events using KQL; it is not the best match for the stated priority.

Answer C is incorrect because Resource logs can be useful in Azure architectures, but its primary role is to capture detailed service-level events beyond subscription control-plane activity; it is not the best match for the stated priority.

 

Question 24

When considering Data Collection Rule (DCR), which requirement supports that choice?

1. To standardize and centrally control guest telemetry collection and routing.
2. To audit management operations performed against Azure resources.
3. To stream Azure telemetry to external analytics or security platforms at scale.
4. To reduce or reshape ingested log data before storage and query processing.

Correct Answer: A

 

Correct Answer

Answer A is correct because Data Collection Rule (DCR) defines what telemetry Azure Monitor Agent collects, how it is transformed, and where it is sent.

Incorrect Answers

Answer B is incorrect because that outcome is more directly associated with Azure Activity Log, not Data Collection Rule (DCR).

Answer C is incorrect because that outcome is more directly associated with Azure Event Hubs, not Data Collection Rule (DCR).

Answer D is incorrect because that outcome is more directly associated with Log Analytics workspace transformation, not Data Collection Rule (DCR).

 

Question 25

When considering Azure Event Hubs, which requirement supports that choice?

1. To stream Azure telemetry to external analytics or security platforms at scale.
2. To retain logs for audit or compliance when interactive querying is not the primary need.
3. To capture detailed service-level events beyond subscription control-plane activity.
4. To investigate and correlate operational events using KQL.

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure Event Hubs provides a high-throughput event ingestion service that can receive routed platform logs for downstream SIEM or custom processing.

Incorrect Answers

Answer B is incorrect because that outcome is more directly associated with Azure Storage account, not Azure Event Hubs.

Answer C is incorrect because that outcome is more directly associated with Resource logs, not Azure Event Hubs.

Answer D is incorrect because that outcome is more directly associated with Azure Monitor Logs, not Azure Event Hubs.