AZ-305 Practice Question 13: SIEM Log Streaming
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 2 · question 3 of 10
A logistics company runs a third-party SIEM in its own datacenter and has no plans to replace it. Security wants the Azure activity log from all 14 subscriptions, plus resource logs from Azure Firewall, Key Vault, and the company's App Service apps, to reach that SIEM within a few minutes of being generated. The same records must also stay queryable by the company's own analysts in a Log Analytics workspace for 90 days. The SIEM vendor supplies a connector that consumes an Apache Kafka-compatible stream, and no agent may be installed on the PaaS resources.
Which design should you recommend?
Show answer and explanation
Answer:
A single diagnostic setting can name several destinations at once, and Microsoft documents the Event Hubs destination specifically for streaming data to external systems such as non-Microsoft SIEM solutions. Event Hubs exposes a Kafka-compatible endpoint, which is exactly what the vendor connector consumes, and the stream is continuous rather than polled. Adding the Log Analytics workspace to the same setting satisfies the analysts' 90-day query requirement without duplicating any collection pipeline, and diagnostic settings are a platform feature, no agent touches the PaaS resources.
Option A meets the collection requirement but not the latency one. Archiving to blobs and polling hourly guarantees the SIEM is up to an hour behind, and it leaves the security team writing and owning download logic that a native destination provides for free.
Option B is back-to-front. The workspace is a query surface, not a streaming source; scheduled API polling adds latency, query cost, and bookmarking logic to avoid gaps and duplicates, and it makes the SIEM's ingestion depend on the workspace staying available.
Option C addresses the wrong layer. The Azure Monitor Agent collects guest operating system data from virtual machines; it cannot collect the subscription activity log or resource logs from Key Vault, Azure Firewall, or App Service, which are platform logs surfaced only through diagnostic settings. It also violates the no-agent constraint without covering the required sources.
Reference: Diagnostic settings in Azure Monitor