“Instrument the application with Azure Monitor Application Insights” relies on this Azure capability: its application telemetry correlates requests, dependencies, and failures. This workload involves A hospital must search VM operating-system events across many subscriptions with Kusto queries. The decisive Azure design mechanism is: a shared workspace supports cross-resource KQL investigation and retention. Thus “Centralize VM logs in an Azure Monitor Log Analytics workspace” is the applicable architecture choice.

“Configure resource diagnostic settings with a Log Analytics workspace destination” relies on this Azure capability: diagnostic settings export selected resource log categories from the control plane. This workload involves A hospital must search VM operating-system events across many subscriptions with Kusto queries. The decisive Azure design mechanism is: a shared workspace supports cross-resource KQL investigation and retention. Thus “Centralize VM logs in an Azure Monitor Log Analytics workspace” is the applicable architecture choice.

“Export the required diagnostic log categories into an Azure Storage account” relies on this Azure capability: storage provides durable long-retention archival outside interactive analytics. This workload involves A hospital must search VM operating-system events across many subscriptions with Kusto queries. The decisive Azure design mechanism is: a shared workspace supports cross-resource KQL investigation and retention. Thus “Centralize VM logs in an Azure Monitor Log Analytics workspace” is the applicable architecture choice.

A would instead validate the other design where a team needs supported Azure resource logs sent to a centralized workspace without changing application code. That evidence is consistent with configure resource diagnostic settings with a Log Analytics workspace destination, because diagnostic settings export selected resource log categories from the control plane. It does not demonstrate that the target case achieves the workspace returns a single time-bounded KQL result spanning the hospital VMs.

C would instead validate the other design where a retail company needs automatic end-to-end tracing across calls in a distributed web application. That evidence is consistent with instrument the application with Azure Monitor Application Insights, because its application telemetry correlates requests, dependencies, and failures. It does not demonstrate that the target case achieves the workspace returns a single time-bounded KQL result spanning the hospital VMs.

D would instead validate the other design where a finance firm must archive Azure resource logs cheaply for forensic retrieval years later. That evidence is consistent with export the required diagnostic log categories into an Azure Storage account, because storage provides durable long-retention archival outside interactive analytics. It does not demonstrate that the target case achieves the workspace returns a single time-bounded KQL result spanning the hospital VMs.

“Configure an Azure Monitor scheduled-query alert” relies on this Azure capability: log-search alerts evaluate KQL results on a schedule. This workload involves A retail company needs automatic end-to-end tracing across calls in a distributed web application. The decisive Azure design mechanism is: its application telemetry correlates requests, dependencies, and failures. Thus “Instrument the application with Azure Monitor Application Insights” is the applicable architecture choice.

“Export the required diagnostic log categories into an Azure Storage account” relies on this Azure capability: storage provides durable long-retention archival outside interactive analytics. This workload involves A retail company needs automatic end-to-end tracing across calls in a distributed web application. The decisive Azure design mechanism is: its application telemetry correlates requests, dependencies, and failures. Thus “Instrument the application with Azure Monitor Application Insights” is the applicable architecture choice.

“Route diagnostic-setting logs to an Azure Event Hubs namespace” relies on this Azure capability: event Hubs supplies a scalable streaming ingress for a downstream consumer. This workload involves A retail company needs automatic end-to-end tracing across calls in a distributed web application. The decisive Azure design mechanism is: its application telemetry correlates requests, dependencies, and failures. Thus “Instrument the application with Azure Monitor Application Insights” is the applicable architecture choice.

A would instead validate the other design where a manufacturing plant must stream Azure platform logs into its existing external security information system. That evidence is consistent with route diagnostic-setting logs to an Azure Event Hubs namespace, because event Hubs supplies a scalable streaming ingress for a downstream consumer. It does not demonstrate that the target case achieves a single failed request can be traced through its dependency calls and exception.

B would instead validate the other design where a finance firm must archive Azure resource logs cheaply for forensic retrieval years later. That evidence is consistent with export the required diagnostic log categories into an Azure Storage account, because storage provides durable long-retention archival outside interactive analytics. It does not demonstrate that the target case achieves a single failed request can be traced through its dependency calls and exception.

C would instead validate the other design where a cloud team needs to execute KQL over logs and trigger action based on matched results. That evidence is consistent with configure an Azure Monitor scheduled-query alert, because log-search alerts evaluate KQL results on a schedule. It does not demonstrate that the target case achieves a single failed request can be traced through its dependency calls and exception.

“Route diagnostic-setting logs to an Azure Event Hubs namespace” relies on this Azure capability: event Hubs supplies a scalable streaming ingress for a downstream consumer. This workload involves A proposed Azure workload has the following constraint: A finance firm must archive Azure resource logs cheaply for forensic retrieval years later. The decisive Azure design mechanism is: storage provides durable long-retention archival outside interactive analytics. Thus “Export the required diagnostic log categories into an Azure Storage account” is the applicable architecture choice.

“Configure suitable Log Analytics table plans and retention settings” relies on this Azure capability: differentiated analytics and retention settings align cost with query frequency. This workload involves A proposed Azure workload has the following constraint: A finance firm must archive Azure resource logs cheaply for forensic retrieval years later. The decisive Azure design mechanism is: storage provides durable long-retention archival outside interactive analytics. Thus “Export the required diagnostic log categories into an Azure Storage account” is the applicable architecture choice.

“Use Application Insights metrics and failure-performance views” relies on this Azure capability: application telemetry exposes request duration, failure trends, and correlated causes. This workload involves A proposed Azure workload has the following constraint: A finance firm must archive Azure resource logs cheaply for forensic retrieval years later. The decisive Azure design mechanism is: storage provides durable long-retention archival outside interactive analytics. Thus “Export the required diagnostic log categories into an Azure Storage account” is the applicable architecture choice.

A would instead validate the other design where a development team must detect rising HTTP exception rates and latency for one web application. That evidence is consistent with use Application Insights metrics and failure-performance views, because application telemetry exposes request duration, failure trends, and correlated causes. It does not demonstrate that the target case achieves older audit blobs remain retrievable after the interactive analytics retention period.

C would instead validate the other design where a manufacturing plant must stream Azure platform logs into its existing external security information system. That evidence is consistent with route diagnostic-setting logs to an Azure Event Hubs namespace, because event Hubs supplies a scalable streaming ingress for a downstream consumer. It does not demonstrate that the target case achieves older audit blobs remain retrievable after the interactive analytics retention period.

D would instead validate the other design where a software business wants interactive querying of recent telemetry while reducing the expense of rarely queried older records. That evidence is consistent with configure suitable Log Analytics table plans and retention settings, because differentiated analytics and retention settings align cost with query frequency. It does not demonstrate that the target case achieves older audit blobs remain retrievable after the interactive analytics retention period.

“Configure suitable Log Analytics table plans and retention settings” relies on this Azure capability: differentiated analytics and retention settings align cost with query frequency. This workload involves During a cloud design workshop, stakeholders explain: A manufacturing plant must stream Azure platform logs into its existing external security information system. The decisive Azure design mechanism is: event Hubs supplies a scalable streaming ingress for a downstream consumer. Thus “Route diagnostic-setting logs to an Azure Event Hubs namespace” is the applicable architecture choice.

“Use the Azure Monitor Logs ingestion API with a data collection rule” relies on this Azure capability: the ingestion API applies DCR-controlled streams and transformations to custom logs. This workload involves During a cloud design workshop, stakeholders explain: A manufacturing plant must stream Azure platform logs into its existing external security information system. The decisive Azure design mechanism is: event Hubs supplies a scalable streaming ingress for a downstream consumer. Thus “Route diagnostic-setting logs to an Azure Event Hubs namespace” is the applicable architecture choice.

“Centralize VM logs in an Azure Monitor Log Analytics workspace” relies on this Azure capability: a shared workspace supports cross-resource KQL investigation and retention. This workload involves During a cloud design workshop, stakeholders explain: A manufacturing plant must stream Azure platform logs into its existing external security information system. The decisive Azure design mechanism is: event Hubs supplies a scalable streaming ingress for a downstream consumer. Thus “Route diagnostic-setting logs to an Azure Event Hubs namespace” is the applicable architecture choice.

A would instead validate the other design where a platform team must send custom application records through a governed ingestion schema and transformation. That evidence is consistent with use the Azure Monitor Logs ingestion API with a data collection rule, because the ingestion API applies DCR-controlled streams and transformations to custom logs. It does not demonstrate that the target case achieves the external security consumer receives freshly generated resource log events from Event Hubs.

B would instead validate the other design where a hospital must search VM operating-system events across many subscriptions with Kusto queries. That evidence is consistent with centralize VM logs in an Azure Monitor Log Analytics workspace, because a shared workspace supports cross-resource KQL investigation and retention. It does not demonstrate that the target case achieves the external security consumer receives freshly generated resource log events from Event Hubs.

C would instead validate the other design where a software business wants interactive querying of recent telemetry while reducing the expense of rarely queried older records. That evidence is consistent with configure suitable Log Analytics table plans and retention settings, because differentiated analytics and retention settings align cost with query frequency. It does not demonstrate that the target case achieves the external security consumer receives freshly generated resource log events from Event Hubs.

“Instrument the application with Azure Monitor Application Insights” relies on this Azure capability: its application telemetry correlates requests, dependencies, and failures. This workload involves A software business wants interactive querying of recent telemetry while reducing the expense of rarely queried older records. The decisive Azure design mechanism is: differentiated analytics and retention settings align cost with query frequency. Thus “Configure suitable Log Analytics table plans and retention settings” is the applicable architecture choice.

“Centralize VM logs in an Azure Monitor Log Analytics workspace” relies on this Azure capability: a shared workspace supports cross-resource KQL investigation and retention. This workload involves A software business wants interactive querying of recent telemetry while reducing the expense of rarely queried older records. The decisive Azure design mechanism is: differentiated analytics and retention settings align cost with query frequency. Thus “Configure suitable Log Analytics table plans and retention settings” is the applicable architecture choice.

“Set the diagnostic settings storage-account destination for supported log categories” relies on this Azure capability: archival delivery writes selected platform diagnostic records to storage. This workload involves A software business wants interactive querying of recent telemetry while reducing the expense of rarely queried older records. The decisive Azure design mechanism is: differentiated analytics and retention settings align cost with query frequency. Thus “Configure suitable Log Analytics table plans and retention settings” is the applicable architecture choice.

A would instead validate the other design where a retail company needs automatic end-to-end tracing across calls in a distributed web application. That evidence is consistent with instrument the application with Azure Monitor Application Insights, because its application telemetry correlates requests, dependencies, and failures. It does not demonstrate that the target case achieves recent records remain queryable and aging data follows the configured retention policy.

C would instead validate the other design where a hospital must search VM operating-system events across many subscriptions with Kusto queries. That evidence is consistent with centralize VM logs in an Azure Monitor Log Analytics workspace, because a shared workspace supports cross-resource KQL investigation and retention. It does not demonstrate that the target case achieves recent records remain queryable and aging data follows the configured retention policy.

D would instead validate the other design where a regulated company needs a durable raw copy of Azure resource diagnostics in its approved storage account. That evidence is consistent with set the diagnostic settings storage-account destination for supported log categories, because archival delivery writes selected platform diagnostic records to storage. It does not demonstrate that the target case achieves recent records remain queryable and aging data follows the configured retention policy.