Design Lab — Route the logs once, and only where they earn their keep
AZ-305 › Unit 1 › Design solutions for logging and monitoring
Design Lab — Route the logs once, and only where they earn their keep
Lab brief
- 1 — Identity, governance, monitoring
- 25–30%
- 20 minutes
- $0 — no subscription needed
- Core
Logging questions look like plumbing and are actually about cost and blast radius. Three different mechanisms move telemetry around Azure — diagnostic settings, workspace data export, and cross-workspace queries — and they are not interchangeable. Candidates lose marks by reaching for a second copy of the data when a query would do, and by assuming every destination can receive everything.
Read the brief, commit to your answers before you reveal, then check them.
The brief
Fabrikam Health — telemetry consolidation
Three subscriptions: Prod-Clinical (West Europe), Prod-Corporate (West Europe), and a Sentinel-owning Security subscription. Roughly 400 resources emit platform logs; a SQL Database and an App Service are the noisiest.
Commit before you reveal
Four answers, written down, before you open anything.
▶Why the commitment matters — open after you have written your answers
The wrong answers in this area are all plausible: they work, they are just billed twice or scoped wrongly. Reading an explanation without having committed lets a plausible answer feel like the one you would have given. Writing it down first is what exposes the difference.
Question 1 — how many settings does a fan-out need?
The SQL Database must send its logs to a Log Analytics workspace, a storage account for the 7-year archive, and an event hub feeding a partner SIEM. What is the minimum number of diagnostic settings on that resource?
Question 2 — what data export can and cannot do
Ops proposes workspace data export to copy corporate tables into the Security workspace for Sentinel. Which statements are true and decide this design? Select all that apply.
Select all that apply
Question 3 — the copy you do not have to make
Ops wants one KQL query spanning corporate resources that are spread across two workspaces, and Security wants to correlate against the clinical workspace WITHOUT PHI leaving it. What should the design use?
Question 4 — the order that controls the bill
Order the logging design method so that cost is decided before it is incurred.
Put the steps in order
- 1Choose destinations per requirement — query, archive, or stream
- 2Decide what must be collected, and what must NOT leave its boundary
- 3Set retention per table: analytics for query, long-term for compliance
- 4Collapse the destinations into the fewest diagnostic settings that carry them
Why the runner-up loses
Three ways to get telemetry somewhere else
| Attribute | Recommended | ||
|---|---|---|---|
| What it moves | A resource's logs, at emission | A workspace's tables, continuously | Nothing — it reads in place |
| Destinations | One of each type: workspace, storage, event hub | Storage account or event hub only | Up to workspaces in one query |
| Hard limit | settings per resource | active rules per workspace, same region | Latency rises with resource count |
| Cost shape | Ingestion at each destination | Billed per exported GB, plus the destination | No second ingestion at all |
| Crosses a data boundary? | Yes — it makes a copy | Yes — it makes a copy | No — data stays put |
The row that decides this scenario is the last one. A copy crosses the boundary; a query does not. Any requirement phrased as "must not leave" is therefore an argument for reading in place, and any requirement phrased as "must survive the workspace" is an argument for a copy. Most wrong answers in this area pick the copy when the requirement only asked to see the data.
The shape of the answer
The traps that catch people
The method, for any question of this shape
How to attack a logging question in 90 seconds
Find the boundary clause
Look for 'must not leave', 'may not be centralised', or a regulator. It eliminates every option that makes a copy, usually before you consider anything else.
Before you move on
Return to this lab after the Unit 1 lessons and answer the four cards cold. If you can state which requirement forces a copy without rereading the brief, the pattern has transferred.