Cram Sheet — Design solutions for logging and monitoring
AZ-305 › Unit 1 › Design solutions for logging and monitoring
Cram Sheet — Design solutions for logging and monitoring
Design the signal path from collection to retention, query, alert, and automated response. Use this sheet after the linked lessons: it is a retrieval map and decision aid, not a substitute for the worked examples.
Cram target
- 1
- Design identity, governance, and monitoring solutions
- 4
- Recommend and reject
Decision matrix
| Requirement shape | Start with | Qualifying rule |
|---|---|---|
| Platform metrics and logs | Azure Monitor and diagnostic settings | Route only required categories to deliberate destinations |
| Cross-resource analytics | Log Analytics workspace | Partition for residency, ownership, access, retention, and cost |
| Application telemetry | Application Insights | Use distributed traces, dependencies, failures, and sampling |
| Long retention or SIEM | Storage/Event Hubs/Microsoft Sentinel | Choose archive, streaming, or security operations deliberately |
The phrase start with matters. A default is only defensible after checking all hard constraints: region and SKU support, protocols, scale, availability, security, residency, recovery, skills, and operating ownership. When two rows appear in one scenario, compose them rather than forcing one service to solve every concern.
Fast design method
- Name the workload boundary and the users or systems that cross it.
- Extract measurable requirements: latency, throughput, volume, RTO/RPO, consistency, outage window, and retention.
- Mark security and governance constraints: identity, network reachability, encryption, residency, audit, and separation of duties.
- Select the simplest viable default from the matrix.
- Test it against failure domains, scale transitions, deployment, monitoring, and cost.
- State the nearest alternative and the one constraint that makes it weaker.
Text equivalent: derive requirements, choose a default, qualify it against constraints, add operational and failure behaviour, then explain the trade-off.
High-value traps
- Activity Log is not guest OS telemetry.
- Alerts need an action path, not only a threshold.
- Workspace centralisation is not automatically least privilege.
Scenario rehearsal
An organisation asks for the capability described by the first matrix row, but also adds a strict recovery target, private connectivity, and a small operations team. Write a recommendation that identifies the core service, the supporting continuity and network controls, and the operating trade-off. Then reject the nearest service alternative using one explicit requirement. If your answer lists products without a traffic, data, identity, or recovery flow, it is incomplete.
Final-minute checklist
- I can distinguish every service in the matrix by requirement, not logo or name.
- I know which controls operate at identity, management, data, and network planes.
- I check regional/SKU support and current limits when a scenario depends on them.
- I include monitoring, health, capacity, recovery, and ownership in the recommendation.
- I can explain why the strongest distractor fails.
Source and freshness
Aligned to the current AZ-305 study guide, the attached Exam Ref, and the attached AZ-305 study guide corpus. Current Microsoft Learn documentation controls product availability, limits, and renamed services. Reviewed 2026-08-02.