Microsoft AZ-500 Practice Test - Questions Answers, Page 23

Answer: A

Explanation:

You need to configure the diagnostic logging for the NetworkSecurityGroupRuleCounter log.

1. In the Azure portal, type Network Security Groups in the search box, select Network Security Groups from the search results then select VNET01-Subnet0-NSG. Alternatively, browse to Network Security Groups in the left navigation pane.

2. In the properties of the Network Security Group, click on Diagnostic Settings.

3. Click on the Add diagnostic setting link.

4. Provide a name in the Diagnostic settings name field. It doesn’t matter what name you provide for the exam. 5. In the Log section, select NetworkSecurityGroupRuleCounter.

6. In the Destination details section, select Archive to a storage account.

7. In the Storage account field, select the logs11597200 storage account.

8. In the Retention (days) field, enter 30.

9. Click the Save button to save the changes.

Answer: A

Explanation:

You need to configure an alert rule in Azure Monitor.

1. Type Monitor into the search box and select Monitor from the search results.

2. Click on Alerts.

3. Click on +New Alert Rule.

4. In the Scope section, click on the Select resource link.

5. In the Filter by resource type box, type locks and select Management locks (locks) from the filtered results. 6. Select the subscription then click the Done button.

7. In the Condition section, click on the Select condition link.

8. Select the Delete management locks condition the click the Done button.

9. In the Action group section, click on the Select action group link.

10. Click the Create action group button to create a new action group.

11. Give the group a name such as Debbie Mobile App (it doesn’t matter what name you enter for the exam) then click the Next: Notifications > button. 12. In the Notification type box, select the Email/SMS message/Push/Voice option.

13. In the Email/SMS message/Push/Voice window, tick the Azure app Push Notifications checkbox and enter [email protected] in the Azure account email field. 14. Click the OK button to close the window.

15. Enter a name such as Debbie Mobile App in the notification name box.

16. Click the Review & Create button then click the Create button to create the action group.

17. Back in the Create alert rule window, in the Alert rule details section, enter a name such as Management lock deletion in the Alert rule name field. 18. Click the Create alert rule button to create the alert rule.

If you want to download the metrics for long-term storage or to analyze them locally, you must use a tool or write some code to read the tables. You must download the minute metrics for analysis. The tables do not appear if you list all the tables in your storage account, but you can access them directly by name. Many storage-browsing tools are aware of these tables and enable you to view them directly (see Azure Storage Client Tools for a list of available tools).

Microsoft provides several graphical user interface (GUI) tools for working with the data in your Azure Storage account. All of the tools outlined in the following table are free.

References:

https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-metrics?toc=%2fazure%2fstorage%2fblobs%2ftoc.json

https://docs.microsoft.com/en-us/azure/storage/common/storage-explorers

Answer: A

Explanation:

Azure Monitor can collect events from the Windows event logs or Linux Syslog and performance counters that you specify for longer term analysis and reporting, and take action when a particular condition is detected. Follow these steps to configure collection of events from the Windows system log and Linux Syslog, and several common performance counters to start with.

Data collection from Windows VM

1. In the Azure portal, locate the WS11641655 Azure Log Analytics workspace then select Advanced settings.

2. Select Data, and then select Windows Event Logs.

3. You add an event log by typing in the name of the log. Type System and then select the plus sign +.

4. In the table, check the severities Error and Warning. (for this question, select all severities to ensure that ALL logs are collected).

5. Select Save at the top of the page to save the configuration.

Reference:

https://docs.microsoft.com/en-us/azure/azure-monitor/learn/quick-collect-azurevm

Answer: A

Explanation:

1. In the Azure portal, type Recovery Services Vaults in the search box, select Recovery Services Vaults from the search results then select Vault1. Alternatively, browse to Recovery Services Vaults in the left navigation pane. 2. In the properties of Vault1, scroll down to the Monitoring section and select Diagnostic Settings. 3. Click the Add a diagnostic setting link.

4. Enter a name in the Diagnostic settings name box.

5. In the Log section, select AzureBackupReport.

6. In the Destination details section, select Send to log analytics

7. Select the WS11641655 Azure Log Analytics workspace.

8. Click the Save button to save the changes.

Reference:

https://docs.microsoft.com/en-us/azure/backup/backup-azure-diagnostic-events

Answer: A

Explanation:

1. In the Azure portal, type SQL in the search box, select SQL databases from the search results then select SQLdb1. Alternatively, browse to SQL databases in the left navigation pane.

2. In the properties of SQLdb1, scroll down to the Security section and select Auditing.

3. Turn auditing on if it isn’t already, tick the Log Analytics checkbox then click on Configure.

4. Select the WS11641655 Azure Log Analytics workspace.

5. Click Save to save the changes.

Reference:

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

Reference:

https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/diagnostics-linux