Observability Blind Spot — Azure Solutions Architect (AZ-305)
You missed a monitoring or logging requirement. The exam tests whether you know what to observe, not just what to build.
Audit Trail vs. Distributed Trace vs. Automated Remediation
'Audit trail' and 'distributed trace' are not interchangeable terms in AZ-305 questions. Activity Log records control-plane changes: who did what to which resource and when. Application Insights traces request failures across service boundaries at the application layer. Azure Monitor with Action Groups detects metric thresholds and fires automated responses. Each capability maps to a distinct service. Treat each of those four phrases as a direct pointer to exactly one service: Activity Log for control-plane audit, App Insights for application tracing, Action Groups for metric-driven automation. Mixing them in a single service selection is always wrong.
The Scenario
A microservices application on AKS experiences intermittent 5-second response times. Azure Monitor shows pod CPU and memory are healthy, no OOM kills, no restarts. You recommend adding more aggressive auto-scaling rules. The correct answer is enabling Application Insights with distributed tracing across all microservices. The distributed trace reveals that Service A calls Service B (50ms), which calls Cosmos DB with a cross-partition query (4,200ms), then returns through the chain. The bottleneck is a Cosmos DB query hitting all partitions because the query filter does not include the partition key. Monitor shows infrastructure health; Application Insights shows application behavior. The scenario asked to "diagnose intermittent slow responses" — that requires application-level observability.
How to Spot It
- •Azure Monitor is infrastructure health (CPU, memory, disk, network). Application Insights is application behavior (request traces, dependency calls, exception telemetry). Log Analytics is aggregation and querying across both. When the scenario describes application-level symptoms (slow responses, failed requests, timeout errors), Application Insights is the answer, not Monitor metrics.
- •Application Insights dependency tracking automatically captures calls to SQL Database, Cosmos DB, Storage, and HTTP endpoints. It shows exactly which dependency call is slow. If the exam describes slow responses in a multi-tier application, the answer involves dependency tracking, not compute scaling.
- •Azure Monitor Workbooks, Dashboards, and Alerts operate on metrics. Application Insights Application Map shows service dependencies and health. The exam tests whether you know which tool answers "what is happening" vs. "why is it happening."
Decision Rules
Route Azure Monitor Activity Log to a Log Analytics workspace via diagnostic settings for ARM control-plane audit retention, rather than extending Application Insights, which is architecturally blind to control-plane events regardless of configuration.
Domain Coverage
Difficulty Breakdown
Related Patterns