AZ-305 - Design Identity, Governance, and Monitoring Solutions - Section 1.1

Design solutions for logging and monitoring including Azure Monitor and Log Analytics.

Design a centralised observability stack using Azure Monitor, Log Analytics workspaces, and diagnostic settings to collect metrics and logs across resources. Configure alerts, action groups, and Azure Monitor Workbooks to surface operational insight and drive automated responses.

Azure MonitorLog Analytics workspacesdiagnostic settingsalerts and action groupsAzure Monitor Workbooks

Practice question for this objective

Free sampleDesign Identity, Governance, and Monitoring Solutionsmedium

A bank runs Windows servers in an on-premises datacentre and Linux servers in AWS that must be monitored alongside Azure VMs using the same Azure Monitor tooling. Which design satisfies the WAF Operational Excellence goal of a single observability surface?

  • AStream Windows Event Log and Syslog to Azure Storage and ingest nightly into a Log Analytics workspace.
  • BConnect the on-premises and AWS servers via Azure Arc and install Azure Monitor Agent on the Arc-enabled servers. Correct
  • CInstall Microsoft Sentinel connectors on every server directly without using Azure Arc.
  • DUse Azure Site Recovery as the monitoring channel for the on-premises and AWS servers.
Azure Arc plus Azure Monitor Agent extends Azure Monitor to on-premises and other-cloud VMs. The VM monitoring overview states that for VMs in other clouds and on-premises, Azure Arc-enabled servers connect them to Azure Monitor; once the Connected Machine agent is installed, you monitor them using the same methods as Azure VMs, including Azure Monitor Agent with DCRs.

Why A is wrong: Nightly Storage uploads break near-real-time monitoring and do not give the unified Azure Monitor experience the team wants.

Why B is correct: Correct. The VM monitoring overview states that for VMs in other clouds and on-premises, Azure Arc-enabled servers connect them to Azure Monitor; once the Connected Machine agent is installed, you monitor them using the same methods as Azure VMs, including Azure Monitor Agent with DCRs.

Why C is wrong: Sentinel connectors are a SIEM ingest pattern, not the documented VM monitoring path for hybrid host telemetry.

Why D is wrong: Site Recovery is a disaster-recovery tool and does not provide monitoring telemetry to Azure Monitor.

See more AZ-305 practice questions, answers explained.

More in this domain

Back to all Design Identity, Governance, and Monitoring Solutions objectives, or the AZ-305 cert hub.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.