AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company uses Microsoft Entra ID. They want to integrate their security operations with a third-party SIEM tool. They need to export all Microsoft Entra ID sign-in logs and audit logs to the SIEM for analysis. The solution should be automated and near real-time. Which Azure service should they configure?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Monitor's log collection capability with real-time streaming, not realizing that Monitor itself cannot natively push logs to external SIEMs without Event Hubs as the intermediary pipeline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Event Hubs
Azure Event Hubs is the correct service because it provides a high-throughput, low-latency data ingestion platform that can receive streaming diagnostic data from Microsoft Entra ID. By configuring diagnostic settings in Entra ID to stream sign-in and audit logs to an Event Hubs namespace, you enable near real-time export to a third-party SIEM tool via the Event Hubs-compatible endpoint, typically using the AMQP or HTTPS protocol.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Event Hubs
Why this is correct
Microsoft Entra ID diagnostic settings can export audit and sign-in logs directly to an Azure Event Hubs namespace, which acts as a highly scalable, low-latency streaming buffer. SIEM platforms can then consume these events using the Event Hubs Kafka-compatible endpoint, making it the optimal choice for near real-time log streaming.
- ✗
Azure Logic Apps
Why it's wrong here
Azure Logic Apps is a workflow orchestration service designed for event-driven integrations, not continuous, high-volume log ingestion. Each log item would require a separate trigger and action execution, introducing transaction costs and processing latency that cannot sustain Entra ID diagnostic log throughput. It also lacks native diagnostic settings integration as a direct streaming destination.
- ✗
Azure Monitor
Why it's wrong here
Azure Monitor stores logs in a Log Analytics workspace and provides querying, alerting, and visualization, but it does not natively stream outgoing data to an external SIEM. To forward Entra ID logs, you would need to configure diagnostic settings to another destination or use a separate connector/export process, making it an intermediary, not a direct streaming transport.
- ✗
Azure Storage
Why it's wrong here
Azure Storage (blob or Data Lake) is primarily for low-cost archiving and long-term retention of Entra ID audit logs, not for near real-time streaming. Diagnostic settings can write logs to storage, but there is no push mechanism to a SIEM; extracting data requires periodic polling or batch jobs, introducing significant latency that defeats the purpose of SIEM streaming.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.