Task 5.1: Monitor resources in Azure

• AEvent | where TimeGenerated > ago(24h) | summarize by Computer

  Incorrect

  summarize with a by clause and no aggregation returns each computer once, without any count.

• BEvent | where TimeGenerated > ago(24h) | summarize count() by EventID

  Incorrect

  This counts records per event ID, not per computer, so the rows don't match what's asked.

• CEvent | where TimeGenerated > ago(24h) | summarize count() by Computer

  Correct

  summarize with the count() aggregation and a by clause returns one row per computer with its number of records.

• DEvent | where TimeGenerated > ago(24h) | summarize dcount(EventID) by Computer

  Incorrect

  dcount returns the number of distinct event IDs per computer, not the number of records.

summarize groups rows by the columns after by and computes an aggregation such as count() for each group; without an aggregation it returns the distinct groups. The where clause with ago(24h) limits the time range first.

• AAn action group with no actions, assigned to each alert rule

  Incorrect

  Editing every rule's action group affects all the resources those rules cover, not only RG-Batch, and limiting it to the window would need manual edits.

• BA scheduled suppression alert processing rule on RG-Batch

  Correct

  Suppression removes action groups from alerts fired at that scope during the schedule, while the alerts remain visible.

• CA scheduled job that disables the alert rules during the window

  Incorrect

  Disabling the rules stops alerts for every resource they cover, and the alerts wouldn't fire at all.

• DAn alert processing rule that adds a second action group

  Incorrect

  Adding an action group sends more notifications; it doesn't silence any.

Alert processing rules act on fired alerts. A suppression rule with a recurring schedule at the RG-Batch scope removes the action groups during maintenance, and the alerts still show in the alert list.

• AA data collection rule for Windows event logs

  Incorrect

  Data collection rules with Windows events gather guest OS data from machines with the Azure Monitor Agent, not resource logs.

• BA diagnostic setting on the key vault

  Correct

  Resource logs aren't collected until a diagnostic setting routes them to a destination such as a Log Analytics workspace.

• CAn activity log alert rule on the key vault

  Incorrect

  An alert rule notifies about events; it doesn't store resource logs for queries, and the activity log holds control plane events only.

• DA metric alert with a dynamic threshold

  Incorrect

  Metric alerts evaluate numeric metrics; they don't collect the vault's audit events.

Platform metrics are collected automatically, but resource logs aren't. A diagnostic setting on the resource sends selected categories to a Log Analytics workspace, a storage account, an event hub or a partner solution.

• AIP flow verify

  Correct

  IP flow verify tests a five-tuple packet against the VM's security and admin rules and reports allow or deny with the rule name.

• BNext hop

  Incorrect

  Next hop doesn't evaluate security rules, so it can't name the rule that allowed or denied the packet.

• CPacket capture

  Incorrect

  Packet capture records traffic on the VM; it doesn't tell you which rule decided the packet.

• DVirtual network flow logs

  Incorrect

  Flow logs record flows over time for analysis; they don't test a packet on demand.

IP flow verify checks a given direction, protocol, local and remote address and port against the configured security rules and returns the result and the rule that decided it. The other tools either don't look at security rules or don't test a single packet on demand.

• AA metric alert on Percentage CPU dropping to zero

  Incorrect

  CPU dropping could mean many things and fires only after metrics stop.

• BA Resource Health alert on the VM

  Incorrect

  Resource Health reports platform health, not who deleted what.

• CA log search alert on the Perf table

  Incorrect

  Perf holds guest performance counters, not delete operations.

• DAn activity log alert on the Delete Virtual Machine operation

  Correct

  Activity log alerts fire on control plane events such as a delete.

Activity log alert rules watch for administrative operations, Service Health and Resource Health events. A rule on the delete operation, scoped to the subscription, catches VM deletions.

• AIt resolves; the user response stays Acknowledged

  Correct

  The system sets the alert condition; the user response changes only when a user changes it.

• BIt's deleted from the alert list

  Incorrect

  Resolved alerts stay in the list.

• CIt stays in the fired state until someone closes it

  Incorrect

  For stateful alerts, the condition is resolved by the system when it clears.

• DIt fires again at each evaluation until closed

  Incorrect

  A stateful alert doesn't fire again until it's resolved.

Alerts have a condition set by the system (fired, resolved) and a user response set by people (New, Acknowledged, Closed). Stateful alerts don't fire again until resolved.

• AStorage insights in Azure Monitor

  Correct

  Storage insights shows performance, capacity and availability across storage accounts.

• BThe storage accounts' activity logs

  Incorrect

  Activity logs show management operations.

• CNetwork insights

  Incorrect

  Network insights covers network resources, not storage accounts.

• DMetrics explorer for each account

  Incorrect

  Metrics explorer works per chart and needs manual building.

Azure Monitor insights give curated views for services. Storage insights covers health, capacity and transactions across accounts at scale.

• AGive each team Log Analytics Reader on the workspace

  Incorrect

  Workspace-wide read lets teams see every resource's logs.

• BResource-context access with resource permissions

  Correct

  In resource context, users see logs for the resources they can access, using their Azure permissions on those resources.

• CA separate workspace per team, linked to the shared one

  Incorrect

  Separate workspaces add cost and management the requirement doesn't need.

• DTable-level RBAC that blocks the workspace's tables

  Incorrect

  Blocking every table stops the teams from seeing anything.

A workspace can be accessed in workspace context or resource context. With the access control mode set to use resource or workspace permissions, resource context limits users to logs of resources they have access to.