Sign in to practice all 30 questions with progress tracking and AI explanations.
1. Which statement correctly distinguishes how Azure Monitor processes metrics versus logs?
- A.Metrics are numerical time-series data ingested as high-volume streams and stored for fast aggregation and alerting, while logs are structured or unstructured records processed and indexed for query and analysis.✓ Correct
- B.Logs are small numerical samples optimized for real-time aggregation and alerting, while metrics are verbose record streams stored for detailed forensic queries and indexing.
- C.Both metrics and logs are stored the same way and use the same ingestion pipeline with identical retention and query features in Azure Monitor.
- D.Metrics are only available in Application Insights, whereas logs are only available in Log Analytics workspaces and cannot be correlated across services.
Explanation
Metrics are time-series numeric streams optimized for fast aggregation and alerts; logs are richer records stored and indexed for detailed queries. Other options invert or overstate platform limitations.
2. When creating a Log Analytics workspace for a production environment, what cost and retention trade-off should you consider?
- A.Choosing a higher ingestion pricing tier increases daily data retention automatically and reduces query costs for historical data, but may increase monthly bills significantly.
- B.Longer data retention increases storage costs and may require selecting longer retention tiers, while reducing retention lowers storage cost but limits historical analysis availability.✓ Correct
- C.Log Analytics workspaces always use free retention and ingestion levels with no cost trade-offs, so retention selection is not relevant for production environments.
- D.Retention has no impact on costs because Azure compresses all logs indefinitely at no extra charge once ingested into a workspace.
Explanation
Longer retention raises storage costs and may need higher-tier settings; reducing retention lowers cost but limits historical queries. Other options are incorrect about pricing.
3. Which workspace scope and region decision best supports compliance and data residency requirements for logs?
- A.Create a dedicated Log Analytics workspace in the region that satisfies data residency rules and assign only compliant resources to that workspace to ensure logs remain in the required geography.✓ Correct
- B.Use a single global workspace in any region because Azure automatically replicates all logs to the subscriber's billing region for compliance purposes.
- C.Create workspaces only in West US because Log Analytics is not available in other regions and centralizes management without affecting residency.
- D.Assign resources to workspaces in different regions randomly because queries can always join across regions without any compliance implications.
Explanation
Creating region-specific workspaces keeps data in required geographies and limits which resources send logs there. Other options incorrectly state replication or availability facts.
4. You need activity logs and resource diagnostic logs retained for 90 days in a central workspace. Which configuration achieves this?
- A.Create a Log Analytics workspace with 90-day retention, configure subscription Activity Log diagnostic setting to send to that workspace, and enable resource-specific diagnostic settings to forward to the same workspace.✓ Correct
- B.Enable only Azure Monitor Alerts because alerts automatically store both activity logs and diagnostic logs for 90 days without configuring diagnostic settings.
- C.Export logs to a storage account with a 30-day lifecycle and rely on storage versioning to extend retention to 90 days without using a Log Analytics workspace.
- D.Configure Application Insights at resource level because Application Insights automatically captures subscription activity logs for 90-day retention.
Explanation
Send activity and resource diagnostic logs to a workspace with the desired retention; alerts or Application Insights do not automatically provide subscription diagnostic retention.
5. After configuring diagnostic settings to send VM guest OS logs to a workspace, you see no data arriving. What is the most likely cause and fix?
- A.The VM lacks the Log Analytics agent or Azure Monitor agent installed and connected to the workspace; installing and connecting the correct agent will allow guest OS logs to flow into the workspace.✓ Correct
- B.Diagnostic settings only work for PaaS services and cannot send VM guest OS logs to a workspace, so switching to a different monitoring tool is required.
- C.The workspace retention must be set to at least 365 days before any data will be accepted; increasing retention will start ingestion for the VM logs.
- D.Guest OS logs require enabling Application Insights on the VM resource; enabling Application Insights will automatically forward guest OS logs to the workspace.
Explanation
Guest OS logs need the appropriate agent installed and connected to the workspace; other options incorrectly describe limitations or unrelated settings.
Practice all 30+ questions in this domain
Start free practice →