Monitor and back up Azure resources

How do you set up Azure Sentinel on Azure?

Create a workspace, and then add that workspace to Azure Sentinel. You'll need to create a Log Analytics workspace.

Which four ways does Site Recovery protect virtual machine infrastructure?

Creates snapshots and recovery points, replicates VMs to a secondary region, supports DR drills, and enables flexible failover/failback. These are the four main features of Site Recovery that will protect your VMs.

Which of the following is NOT a state of a smart group alert?

Failed

You create a custom chart and pin it to an Application Insights dashboard. Other users of the dashboard can't see the new chart. What should you do to resolve the problem?

Re-publish the Application Insights dashboard. When you make changes to a dashboard in Azure, other dashboard users won't see the changes until you publish them.

How does Site Recovery support grouping of machines and workloads?

Recovery plans. Recovery plans enable you to group VMs around workloads. For example, a recovery plan protecting a company's e-commerce website would include the web server, database server, and API server.

Which restore type should you select if you want to replace a disk on an existing virtual machine?

Replace existing Selecting this option allows for a disk to be restored and then used to replace a disk on an existing VM.

How can you continuously monitor your applications from different geographic locations?

Use availability tests to continuously monitor your application from different geographic locations. Availability tests let you monitor your application from multiple locations in the world.

What do you have to install or create to store simple boot diagnostics in Azure?

An Azure storage account. You need a storage account to store boot diagnostics data, the boot screenshots, and logs.

What's the composition of an alert rule?

Resource, condition, actions, alert details

An SLA is important to define for your service because:

It helps you determine the availability of your service that you will commit to for your customers. Service level agreement is a commitment you are making to your customers for the availability of your service.

What data does Azure Monitor collect?

Data from a variety of sources, such as the application event log, the operating system (Windows and Linux), Azure resources, and custom data sources

Which of the following is not used in a highly available architecture?

A recovery service vault Recovery service vaults provide a destination for backups, but they are not part of a highly available architecture.

What is the schema?

A series of tables logically grouped together, which allow for an easy understanding behind how Log Analytics stores logs The schema provides a simple way to understand data organization in Log Analytics.

You want to make sure that admins know as soon as a web app becomes overloaded. Which feature of Application Insights should you use?

Alerts You can create an alert that triggers when a condition is satisfied - for example, when the web app is overloaded. When the alert triggers, you can configure it to send an email, for example, to inform admins.

Why is it important to test restores regularly?

All of the above: 1. To validate the integrity of your backups 2. To become familiar with the restoration process 3. To identify gaps in your backup and restore processes.

How are smart groups created?

Automatically, using machine learning algorithms.

Which Azure capability offers operations teams a pre-defined monitoring experience across multiple resources?

Azure Monitor Insights Several Azure resources have dedicated Insights, which offer curated monitoring experiences with pre-defined visualizations of usage and performance across multiple subscriptions, resource groups and resources for the specific resource type.

What is the shared underlying logging data platform for Azure Sentinel and Azure Security Center?

Azure Monitor Logs Several services in Azure including Sentinel and Security Center use Azure Monitor Logs as their underlying logging data platform.

How does Azure Monitor organize log data for queries?

Azure Monitor organizes log data into tables. Azure Monitor organizes log data in tables, each composed of multiple columns. Every query contains data that's organized into a hierarchy similar to SQL (databases, tables, and columns).

Where can IT Operations teams find a topology view with network connection details of their VMs and scale sets?

Azure Monitor virtual machine insights Azure Monitor virtual machine insights include a map tab with a topology view that shows the processes, dependencies, and network connection details of your VMs and scale sets.

You have a Linux-based web app that runs in the Azure App Service. You want to display basic performance data in an Application Insights dashboard. Which method should you use to instrument your app?

Build-time instrumentation Because your app is based on Linux, you need to use build-time instrumentation. Runtime instrumentation and automatic client-side telemetry are available only for Windows apps.

Which Azure service incorporates threat intelligence for detection and investigation in their enterprise environment?

Azure Sentinel Azure Sentinel includes built-in threat intelligence for detection and investigation that can help reduce false positives.

Where should DevOps teams implement application monitoring to improve application health and performance?

During development and while in production Monitoring applications in development prevent errors and exceptions later in production. By monitoring applications in production, you'll promptly identify problems and risks that affect users.

True or false: all Azure data storage options include automatic backup of data?

False Most Azure services offer integrated backup functionality, but it is not always enabled by default. You can also add services like Azure Backup Agent as needed to make sure all your data is protected.

True or false: data replication and data backup are the same thing.

False Replication creates real-time or near-real-time copies of live data for use in failover during execution. Backup creates long-lived, read-only snapshots of data for use in recovery,

Which of the following is an example of a log data type?

HTTP response records

You've enabled Application Insights for your web app. In which of the following Azure resources will telemetry data be stored for the app?

In the Application Insights resource. The web app sends its telemetry data to the Application Insights resource, where it's stored for analysis.

What two fundamental types of data does Azure Monitor collect?

Metrics and logs Azure Monitor collects two types of data: metrics and logs. Metrics are numerical values that describe some aspect of a system at a particular time. Logs contain different kinds of data, such as event information, organized into records.

Which of the following can be excluded from your recovery steps in your recovery plan?

None of the above should be excluded in a recovery plan. 1. How to restore backups 2. How to fail over to replicated systems 3. How to reestablish network connectivity to on-premises or external networks *should all be included*

What does Azure Monitor for VMs provide?

Provides access to log data without exposing the user to underlying queries. Allows deeper performance analysis of a virtual machine without query building.

You start out by talking to individual business units about monitoring wants and needs at the start of your assignment. You determine each business unit only needs to query logs generated from their resources. Which access model would you select for your Log Analytics deployment?

Resource-context Provides access to view logs for resources in all tables you have access to. Queries are scoped to only data associated with that resource.

How are storage accounts used by Site Recovery to store data backups?

Site Recovery creates recovery services vaults. Recovery services vaults are used to store backup data, VM configuration settings, and workloads.

You want to replace a disk on an existing VM but receive an error. What's the possible reason?

The existing VM has been deleted and is no longer available

You want to track the average CPU usage of your Azure virtual machine over the last seven days. What is the most straightforward way to do this?

View the metrics for the virtual machine on the Overview page and set the range to the last seven days. The Overview page displays this graph by default. You can set the range to show a seven-day range.

How can you prevent persistent access to your virtual machines by using Azure Security Center?

Use just-in-time access to prevent persistent access. With just-in-time access, your virtual machines are only accessed based on rules that you configure.

Which tool allows you to automate your responses to alerts?

Use playbooks to automate your response to alerts. Playbooks are automated procedures that you can run against alerts.

Sentinel has raised an incident. How can you investigate which users have been affected?

Use the investigation map, drill down into the incident, and look for user entities affected by the alert. Use entities to view users that might have been in the path of a particular threat or malicious activity.

What aspect of application performance can be monitored by DevOps teams when using Azure Monitor Application Insights?

User behavior and usage patterns for your application Instrumenting your web pages with Application Insights collects usage information to augment the server-side monitoring capabilities.

Why would you use Azure Sentinel?

You want a detailed overview of your enterprise, potentially across multiple clouds, and on-premises locations. Azure Sentinel will help monitor and respond to security threats across your entire enterprise.

Why would you use Azure Application Insights?

You want to analyze and address problems that affect your application's health. You can analyze and address issues such as exceptions, failures, and availability problems.

Why would you use Azure Security Center?

You want to secure an infrastructure that consists of on-premises and cloud resources. Azure Security Center helps you secure your on-premises and cloud resources.