AZ-305 - Design Identity, Governance, and Monitoring Solutions (27% of the exam) - Section 1.1

Design solutions for logging and monitoring including Azure Monitor and Log Analytics.

Design a centralised observability stack using Azure Monitor, Log Analytics workspaces, and diagnostic settings to collect metrics and logs across resources. Configure alerts, action groups, and Azure Monitor Workbooks to surface operational insight and drive automated responses.

Azure MonitorLog Analytics workspacesdiagnostic settingsalerts and action groupsAzure Monitor Workbooks

Practice question for this objective

Free sampleDesign Identity, Governance, and Monitoring Solutionsmedium

A bank runs Windows servers in an on-premises datacentre and Linux servers in AWS that must be monitored alongside Azure VMs using the same Azure Monitor tooling. Which design satisfies the WAF Operational Excellence goal of a single observability surface?

AStream Windows Event Log and Syslog to Azure Storage and ingest nightly into a Log Analytics workspace.
BConnect the on-premises and AWS servers via Azure Arc and install Azure Monitor Agent on the Arc-enabled servers. Correct
CInstall Microsoft Sentinel connectors on every server directly without using Azure Arc.
DUse Azure Site Recovery as the monitoring channel for the on-premises and AWS servers.

Azure Arc plus Azure Monitor Agent extends Azure Monitor to on-premises and other-cloud VMs. The VM monitoring overview states that for VMs in other clouds and on-premises, Azure Arc-enabled servers connect them to Azure Monitor; once the Connected Machine agent is installed, you monitor them using the same methods as Azure VMs, including Azure Monitor Agent with DCRs.

Why A is wrong: Nightly Storage uploads break near-real-time monitoring and do not give the unified Azure Monitor experience the team wants.

Why B is correct: Correct. The VM monitoring overview states that for VMs in other clouds and on-premises, Azure Arc-enabled servers connect them to Azure Monitor; once the Connected Machine agent is installed, you monitor them using the same methods as Azure VMs, including Azure Monitor Agent with DCRs.

Why C is wrong: Sentinel connectors are a SIEM ingest pattern, not the documented VM monitoring path for hybrid host telemetry.

Why D is wrong: Site Recovery is a disaster-recovery tool and does not provide monitoring telemetry to Azure Monitor.

See more AZ-305 practice questions, answers explained.

Exam traps in Design Identity, Governance, and Monitoring Solutions

Answers that look right on this material and are not. Each one is a distractor from a different question in the AZ-305 bank for this domain.

Container Insights replaces managed Prometheus when both are enabled on the same cluster.
Why it is wrong: The two services are complementary, not exclusive; Microsoft positions metrics through managed Prometheus and logs through Container Insights on the same cluster.
Container Insights with container log collection
Why it is wrong: Container Insights collects stdout, stderr, and Kubernetes event records into a Log Analytics workspace queried with KQL, not Prometheus counters in an Azure Monitor workspace queried with PromQL.
Add an Azure Monitor alert processing rule that suppresses repeated fires from the activity log alert.
Why it is wrong: Suppression hides notifications but does not give the team the stateful fire-and-resolve lifecycle they are asking for.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.