Exam AZ-305 topic 1 question 57 discussion

A. 1 You only need a single Azure Monitor Log Analytics workspace for all these monitoring solutions. Here's why: - Azure Monitor Network Insights, Application Insights, Microsoft Sentinel, and VM insights, all of these components can send their data to a Log Analytics workspace. - The workspace is a unique environment for Azure Monitor log data. Each workspace has its own data repository and configuration, and data sources and solutions are configured to store their data in a workspace. Therefore, a single Azure Monitor Log Analytics workspace can be utilized to collect and analyze data from all the components of the monitoring solution. This will also enable a unified management and analysis of the collected data.

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design

Use 3 workspaces minimum when combining Sentinel + App Insights + VM/Network Insights. DCR (Data Collection Rules) are key for sharing workspaces efficiently between VM/Network Insights. Do not mix Sentinel with Application Insights in the same workspace.

The minimum number of Azure Monitor workspaces required for your monitoring solution is A. A single Azure Monitor workspace can handle multiple monitoring solutions, including Azure Monitor Network Insights, Application Insights, Microsoft Sentinel, and VM insights. This approach simplifies management and reduces complexity, making it easier for your team to handle all monitoring tasks from a centralized location.

Today's exam question

Only workspace works for all monitoring solutions.

I would go for A hence 1 https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design

I think it's A indeed.

Minimum is 1

Correcta, A

This question has no sense, depends by situations and strategies. From https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design 1) A single Log Analytics workspace might be sufficient for many environments that use Azure Monitor and Microsoft Sentinel. But many organizations will create multiple workspaces to optimize costs and better meet different business requirements. 2) Design strategy: Your design should always start with a single workspace to reduce the complexity of managing multiple workspaces and in querying data from them. 3) The decision whether to combine your operational data from Azure Monitor in the same workspace as security data from Microsoft Sentinel or separate each into their own workspace depends on your security requirements and the potential cost implications for your environment.

Option A is correct.

With workspace-based resources, Application Insights sends telemetry to a common Log Analytics workspace, providing full access to all the features of Log Analytics while keeping your application, infrastructure, and platform logs in a single consolidated location.

When you enable VM insights on a single virtual machine or virtual machine scale set by using the Azure portal, you can select an existing workspace or create a new one

You can use a single workspace for all your data collection. You can also create multiple workspaces based on requirements such as: The geographic location of the data. Access rights that define which users can access data. Configuration settings like pricing tiers and data retention. https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace-overview

A. No doubt.

The Correct answer is C Azure Monitor Network Insights requires a separate workspace. Application Insights requires a separate workspace. Microsoft Sentinel and VM insights can share a workspace.