Security Log Monitoring for Azure Virtual Machines
Question
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains two administrative user accounts named Admin1 and Admin2.
You create two Azure virtual machines named VM1 and VM2.
You need to ensure that Admin1 and Admin2 are notified when more than five events are added to the security log of VM1 or VM2 during a period of 120 seconds.
The solution must minimize administrative tasks.
What should you create?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.B
The correct answer is A. two action groups and two alert rules.
Explanation:
To achieve the objective of notifying Admin1 and Admin2 when more than five events are added to the security log of VM1 or VM2 during a period of 120 seconds, we need to create an alert rule that monitors the security log of the virtual machines and an action group that specifies who should be notified and how.
Action Groups: An action group is a collection of notification preferences and actions that can be used across multiple alert rules. By using an action group, we can avoid creating the same notification settings repeatedly for each alert rule.
In this scenario, we need to create two action groups - one for Admin1 and another for Admin2. These action groups should specify how these users should be notified when the alert rule is triggered. For example, we can specify that an email notification should be sent to their email addresses or a text message should be sent to their mobile phones.
Alert Rules: An alert rule defines the conditions that trigger an alert, and specifies the action group that should be notified when the alert is triggered. In this scenario, we need to create two alert rules - one for VM1 and another for VM2. These alert rules should monitor the security log of the virtual machines and trigger an alert when more than five events are added to the log during a period of 120 seconds.
Since we have two virtual machines, we need to create two alert rules, each with its own action group. Therefore, the correct answer is A. two action groups and two alert rules.
Option B, one action group and one alert rule, would not work because we need to create separate alert rules for each virtual machine.
Option C, five action groups and one alert rule, would create unnecessary complexity because we only need to notify two users.
Option D, two action groups and one alert rule, would not work because we need to create separate alert rules for each virtual machine.
