AZ-400 Implement an instrumentation strategy Practice Question
You are designing a centralized logging strategy for multiple microservices hosted in Azure Kubernetes Service (AKS). Each microservice writes logs in JSON format to stdout/stderr. The operations team needs to query logs across all services and correlate them with application performance metrics. Which solution provides the best integration?
⚠ Common exam trap
Test-takers frequently confuse Application Insights (designed for application-level telemetry) with Container Insights (designed for container-level logs and metrics), leading them to choose Option D, which lacks the native AKS metric correlation and Log Analytics workspace integration required for centralized querying.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Container Insights in Azure Monitor to collect stdout/stderr logs and metrics into a Log Analytics workspace.
Container Insights in Azure Monitor is the best solution because it natively collects stdout/stderr logs from AKS containers and correlates them with performance metrics (CPU, memory, disk, network) in a single Log Analytics workspace. This enables the operations team to query logs across all microservices using KQL and join them with metrics for end-to-end troubleshooting, without additional infrastructure or data movement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure AKS to send logs to Azure Blob Storage and use Azure Storage Analytics for querying.
Why it's wrong here
Azure Blob Storage is an object store designed for archival and unstructured data, not for interactive log analytics. Azure Storage Analytics provides only coarse-grained metrics and limited querying (e.g., per-hour transaction logs), which cannot efficiently filter or aggregate container stdout/stderr at the scale required for centralized logging.
- ✓
Enable Container Insights in Azure Monitor to collect stdout/stderr logs and metrics into a Log Analytics workspace.
Why this is correct
Container Insights is the native Azure Monitor solution for AKS: it deploys a Log Analytics agent as a DaemonSet to collect stdout/stderr logs, performance metrics, and container inventory into a Log Analytics workspace. This enables rich Kusto Query Language (KQL) queries, alerting, and correlation with other Azure Monitor data, making it the correct centralized logging approach for AKS workloads.
- ✗
Stream logs to Azure Event Hubs and then to Azure Data Explorer for analysis.
Why it's wrong here
Azure Event Hubs is a high-throughput ingestion and transport service, not a storage or query engine. While streaming logs to Event Hubs is suitable for real-time event ingestion, it still requires a downstream analytics store (like Azure Data Explorer) for querying; using Event Hubs alone as the log store would not meet centralized logging requirements, and adding Azure Data Explorer lacks native AKS integration compared to Container Insights.
- ✗
Deploy the Application Insights agent as a DaemonSet in AKS and send logs directly to Application Insights.
Why it's wrong here
Application Insights is designed for application-level telemetry (requests, traces, exceptions) generated from code instrumentation, not for bulk infrastructure log ingestion. Deploying the Application Insights agent as a DaemonSet to capture stdout/stderr logs would flood Application Insights with high-volume, low-value logs, resulting in excessive cost and poor query performance; it also bypasses the built-in Log Analytics integration that Azure Monitor provides for AKS log collection.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Log Analytics
Log Analytics is a cloud-based service that collects, analyzes, and visualizes machine-generated log data from various sources to help IT teams monitor systems and troubleshoot issues.
Key term
Azure Monitor
Azure Monitor is a cloud service that collects, analyzes, and acts on telemetry data from your Azure and on-premises resources to help you understand performance and availability.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.