Azure Monitor Flashcards

Question

What is the retention period for Azure Monitor Logs?

Answer 1

By default, logs are retained for 30 days, but the retention period can be configured.

Answer 2

A central repository for storing and analyzing log data using KQL.

Answer 3

Azure Monitor can integrate with tools like Grafana, Power BI, and external SIEM systems.

Answer 4

Costs are based on the volume of data ingested, stored, and the number of alerts set.

Answer 5

A collection of insights (e.g., VM Insights, Container Insights) to monitor the health and performance of specific resources.

Answer 6

Through Application Insights, which monitors application performance, user behavior, and diagnostics.

Answer 7

To collect and analyze log data from Azure resources and applications for troubleshooting and auditing.

Answer 8

Workbooks allow you to create customizable visual reports for better insight into monitoring data.

Answer 9

Any system or application that sends data to Azure Monitor, such as VMs, apps, or databases.

Answer 10

Logs that capture events and activity within Azure resources, providing insight into their behavior.

Answer 11

An API that allows programmatic access to metrics data from Azure Monitor.

Answer 12

By using Kusto Query Language (KQL) in the Log Analytics Workspace.

Answer 13

It automatically adjusts resource capacity based on performance data collected by Azure Monitor.

Answer 14

The process of collecting and storing log data from resources and services in Azure Monitor.

Answer 15

By collecting metrics and logs to identify performance issues and errors in applications or resources.

Answer 16

It allows you to define and track custom metrics specific to your application or resource needs.

Answer 17

An API that enables developers to retrieve monitoring data programmatically from Azure Monitor.

Answer 18

A feature that monitors SAP systems running on Azure for performance and health.

Answer 19

By analyzing metrics and logs to provide insights into underused or overused resources.

Answer 20

It provides logging and monitoring that can be used to meet compliance requirements.

Answer 21

By collecting logs and metrics that can help detect security threats or anomalies.

Answer 22

A tool that tracks and analyzes changes to Azure resources, helping to identify potential issues.

Answer 23

By using historical performance data to predict future resource requirements.

Answer 24

To trigger alerts when performance metrics exceed or fall below the defined limits.

Answer 25

An alert triggered based on a query that runs against log data in a Log Analytics Workspace.

Answer 26

By collecting data from both Azure and non-Azure environments for a unified monitoring view.

Answer 27

Azure AutoScale is part of Azure Monitor; it enables resources such as Virtual Machine Scale Set to be increased based on Azure Monitor Metric Value from an Azure Resource being monitored.

Answer 28

1. Per GB (Pay-As-You-Go) Pricing Tier Data Ingestion: You pay based on the amount of data ingested into Azure Monitor. The cost is per GB of data ingested. Data Retention: Data can be retained for free for the first 31 days. Beyond this, you pay a per-GB rate for retention. Log Analytics Query Charges: No additional cost for querying the data stored in the workspace. Features: Log collection and analysis from multiple sources. Basic monitoring metrics and insights. Alerts and notifications. Azure Monitor Logs, Alerts, Metrics, Application Insights. 2. Insight and Analytics (Legacy Pricing Tier) This tier provides more detailed analytics but is not typically available for new customers, as it is part of legacy plans. Fixed Fee: Pricing is typically based on a set amount of included data per day. Additional Data: If usage exceeds the daily included amount, extra charges apply per GB. Data Retention: Data can be retained for free for the first 31 days, with charges for extended retention. 3. Add-ons for Azure Monitor: Application Insights: Costs based on data ingested per GB. Azure Monitor Metrics: Free up to a certain number of standard metrics. Custom metrics have an additional cost per GB. Log Alerts: Alerts based on query results, charged per query and frequency.

Answer 29

After 31 data will be deleted if there is not a retention period set.

Answer 30

1. Pay-as-you-go (ingestion and retention): You pay based on the volume of data ingested per GB and the retention period beyond the first included free days. 2. Application Insights: Charged based on the volume of telemetry data collected by Application Insights from your applications, often integrated with Azure Monitor for comprehensive monitoring. 3. Log Analytics Add-ons: Additional features, such as alerting, enhanced security, or performance monitoring, come at extra costs. 4. Dedicated Capacity: For large-scale data ingestion, there’s an option to reserve capacity, offering a fixed cost per unit of reserved capacity.

Answer 31

It is a mix of both regional and global services

Answer 32

Azure Log Analytics Workspaces are regional resources. When you create a Log Analytics workspace, you must select a region where it will be hosted. All the data stored and processed in that workspace remains within the selected region, and this choice impacts data residency, latency, and compliance with regional data regulations.

Answer 33

Azure container insights?

Answer 34

Azure Monitor Container Insights helps monitor the performance and health of Kubernetes clusters and containers running on them.

Answer 35

Azure Kubernetes Service (AKS), Kubernetes running on Azure Stack, Any Kubernetes cluster hosted on other platforms.

Answer 36

No, not directly.

Answer 37

Azure monitoring provide for: Log streaming View streaming system and console logs from a container in near real-time. Container console Connect to the Linux console in your containers to debug your application from inside the container. Azure Monitor metrics View and analyze your application's compute and network usage through metric data. Application logging Monitor, analyze, and debug your app using log data. Azure Monitor Log Analytics Run queries to view and analyze your app's system and application logs. Azure Monitor alerts Create and manage alerts to notify you of events and conditions based on metric and log data.

Answer 38

You can use Azure Monitor Container Insights.

Answer 39

Use Azure Monitor Service Health; you can define what service in what region are to be monitored, you can use action groups.

Answer 40

Sign-in logs

Answer 41

Yes, Azure Entra ID provides sign-in logs under monitoring

Answer 42

Audit logs provide records of all changes made to resources in Azure Entra ID. This includes activities like user creation, group modification, role changes, and license assignments. Each log entry includes details such as who performed the action, what was changed, and when the action occurred, helping administrators track resource modifications for compliance and governance purposes.

Answer 43

These logs record each user's sign-in activity. Information includes who signed in, when, and from where, along with details such as IP address, device, and application used. Sign-in logs are useful for analyzing authentication patterns, identifying suspicious activity, or troubleshooting login issues.

Answer 44

These logs capture sign-in attempts by non-interactive users, which are typically automated processes such as background services or scheduled tasks that authenticate without requiring direct user interaction (e.g., accessing an application with a token). Monitoring these logs helps detect unexpected automated sign-ins or bot activities.

Answer 45

Service principals are the identities associated with applications and services that need to authenticate in Azure Entra ID. These logs track the sign-in attempts of service principals and help in troubleshooting application access issues and ensuring security around how applications are accessing resources.

Answer 46

Managed identities are special identities in Azure used by services to authenticate without storing credentials. These logs capture the sign-in attempts of managed identities, which are often used by applications and services to securely access Azure resources.

Answer 47

Provisioning logs track the creation, update, and deletion of users, groups, and applications within Azure Entra ID, typically as part of automated user or group provisioning workflows (e.g., SCIM provisioning for SaaS apps). They provide insight into synchronization operations, including success and failure details.

Answer 48

These logs track authentication requests that go through Active Directory Federation Services (ADFS), a service used to provide federated authentication. Monitoring these logs helps troubleshoot federated login issues and track the health of ADFS infrastructure.

Answer 49

Risky user logs provide information about users that have been flagged as high risk by Azure Entra Identity Protection. These users might have been involved in suspicious activities such as signing in from unusual locations or exhibiting compromised credentials, enabling administrators to take appropriate remediation actions.

Answer 50

These logs capture the specific events that contribute to marking a user as risky, such as sign-ins from unfamiliar devices, atypical behavior, or known password leaks. They are a critical part of risk-based conditional access policies.

Answer 51

These logs track traffic and access patterns associated with network-based authentication events. They help monitor the behavior of users and services as they access Azure resources via Azure Entra ID, providing insights for network performance and security analysis.

Answer 52

Similar to risky user logs, these logs identify service principals (applications or services) that have been flagged as risky, often due to suspicious or abnormal behavior such as unusual authentication attempts or unexpected changes in permissions.

Answer 53

These logs document specific events contributing to the identification of risky service principals. Examples include failed authentication attempts or attempts to access sensitive data from unexpected locations.

Answer 54

These logs provide detailed audit trails for activities in Office 365 that are enriched with data from Azure Entra ID. They include actions such as user and group management, login attempts, and changes to permissions in Office 365 applications like Exchange, SharePoint, and Teams.

Answer 55

These logs capture activities and requests made through the Microsoft Graph API, which is the gateway to accessing data and insights across Microsoft services. These logs are helpful in monitoring application access patterns and ensuring proper use of APIs.

Answer 56

These logs capture the health and performance of network connectivity for remote workers accessing Azure services. It helps in understanding the quality and reliability of network access from remote locations and identifying potential connectivity issues impacting user experience.

Answer 57

These alerts are generated based on unusual or suspicious network access patterns, such as an unexpected surge in authentication requests from a specific IP range or geolocation. They help administrators quickly detect and respond to potential security incidents.

Answer 58

Diagnostic logs are sent to your azure storage account, and you can decide how long to keep them.

Answer 59

By default, 30 days, but you can decide to keep them for 730 days

Answer 60

To collect performance metrics from custom resources using Azure Monitor, you can leverage Azure Monitor's custom metrics feature by deploying: Azure Monitor Agent Application Insights

Answer 61

The Azure Monitor Agent (AMA) supports log and metric data collection for Azure resources. It is a unified agent designed to collect telemetry from various sources and send it to different destinations in Azure Monitor, such as Log Analytics workspaces or Application Insights.

Answer 62

To capture logs and metrics from a Linux server in Azure, install the Azure Monitor Agent (AMA) on the server. Configure the agent to collect data such as performance metrics, syslog, and custom logs. Send this data to Azure Monitor by specifying the destination Log Analytics workspace in the agent configuration settings.

Answer 63

No, the Azure Monitor Agent (AMA) is not automatically installed when a VM is deployed in Azure; it requires a separate installation and configuration process if you want to use it to collect telemetry data (logs and metrics) from that VM. Here’s a quick breakdown: 1. Automatic Deployment of Diagnostics vs. AMA: When you deploy a VM in Azure, diagnostic settings are available for capturing some basic metrics and activity logs, but AMA is not automatically included. To gain advanced monitoring capabilities (custom logs, detailed metrics), you need to explicitly install AMA on the VM. 2. Installing AMA After VM Deployment: AMA can be installed post-deployment using Azure Policy, which allows you to enforce installation across multiple VMs automatically. You can also manually install AMA using the Azure portal, Azure CLI, PowerShell, or automation tools like Azure Resource Manager (ARM) templates. 3. Using AMA for Comprehensive Monitoring: AMA provides a unified agent for both metrics and logs, allowing you to create Data Collection Rules (DCRs) that specify exactly what data to collect and where to send it (e.g., Log Analytics workspace). It’s suitable for Azure VMs as well as on-premises and multi-cloud environments, making it a flexible choice for hybrid setups.

Answer 64

No, the Azure Monitor Agent that collects logs and metrics is a separate install and configuration.

Answer 65

Use Azure Policy to automate the deployment of the agent across multiple VMs in you orgnization.

Answer 66

You can manually enable it on the virtual machine, or if you want it to be deployed more widely across the organization, you can use a policy to define how it is deployed.

Answer 67

Application code level metrics

Answer 68

Applications: Virtual machines: Guest operating systems: Containers: including Prometheus metrics Databases: Security events: in combination with Azure Sentinel Networking: events and health in combination with Network Watcher Custom sources: that use the APIs to get data into Azure Monitor

Answer 69

Yes, this is supported.

Answer 70

Azure Monitor has a Network Watcher, and it has a Topology view.

Answer 71

It enables you to connect a connection from a virtual machine to a destination (IP, FQDN) (PORT) and have a record of round trip time (latency) and probes failed). The capture probe latency is saved, and you can see it.

Answer 72

It enables you to connect a connection from a virtual machine to a destination (IP, FQDN) (PORT) and have a record of round trip time (latency) and probes failed). The capture probe latency is saved, and you can see it.

Answer 73

It is an APM (application performance management) service thet is part of Azure Monitor.

Answer 74

Azure Monitor Application Insights Application Map creates a visual map of the application cop[onents of the applications.

Answer 75

Azure Monitor Application Insights Application Map creates a visual map of the application cop[onents of the applications.

Answer 76

Azure Monitor Application Insights Profiler is a performance monitoring tool designed to help developers and IT professionals analyze the performance of .NET applications running in Azure. It captures detailed performance traces, enabling you to identify performance bottlenecks, optimize code, and enhance the overall efficiency of your applications. Key Features: Automatic Profiling: Profiler runs automatically at regular intervals, capturing performance data without manual intervention. It can also be triggered based on specific conditions, such as high CPU or memory usage. Low Overhead: Designed for production environments, Profiler adds minimal overhead, typically between 5% to 15% of CPU and memory usage during active profiling sessions. Detailed Trace Analysis: Provides in-depth insights into the execution of your application, including call stacks and the time spent on various methods, helping you pinpoint performance issues. Integration with Application Insights: Seamlessly integrates with Azure Monitor Application Insights, allowing you to correlate performance data with other telemetry, such as logs and metrics, for a comprehensive view of your application's health.

Answer 77

Azure Monitor Application Insights User Flows is a feature that visualizes the navigation paths users take through your web application. It helps you understand how users interact with your app, identify common navigation patterns, and detect potential bottlenecks or drop-off points. By analyzing these flows, you can optimize the user experience and improve application performance. To utilize User Flows, ensure your application is instrumented with the Application Insights SDK. Once set up, you can access the User Flows feature in the Azure portal under the Application Insights resource for your application. This feature provides a visual representation of user navigation, highlighting the most common paths and areas where users may encounter issues.

Answer 78

Azure Monitor Application Insights Telemetry is a feature of Azure Monitor that enables you to collect, analyze, and act upon telemetry data from your applications. This telemetry encompasses various types of data, including: Requests: Logs of incoming requests to your application, detailing their success or failure, duration, and other relevant metrics. Dependencies: Information about external calls your application makes, such as database queries or API calls, including their performance and outcomes. Exceptions: Records of errors and exceptions that occur within your application, aiding in diagnosing and resolving issues. Traces: Diagnostic log messages that provide insights into the application's behavior and flow. Metrics: Quantitative measurements like CPU usage, memory consumption, or custom metrics you define.