Examkin

Question

Difficulty: MediumLog Analytics Workspaces and KQL Queries

You have an Azure subscription containing a Log Analytics workspace named Workspace1. Multiple Azure virtual machines in different resource groups send their performance metrics and diagnostic logs to Workspace1. You need to allow a user named User1 to run Kusto Query Language (KQL) queries to analyze the CPU usage of only the virtual machines located in a resource group named RG-Prod. User1 must not be able to view logs for virtual machines in other resource groups. Which configuration should you implement?

  1. Assign User1 the Reader role on RG-Prod, and configure the access control mode of Workspace1 to use resource or workspace permissions.Answer
  2. B
    Assign User1 the Log Analytics Reader role on Workspace1, and configure the access control mode of Workspace1 to require workspace permissions.
  3. C
    Assign User1 the Reader role on RG-Prod, and configure the access control mode of Workspace1 to require workspace permissions.
  4. D
    Assign User1 the Monitoring Reader role on Workspace1, and configure the access control mode of Workspace1 to use resource or workspace permissions.

Answer

Assign User1 the Reader role on RG-Prod, and configure the access control mode of Workspace1 to use resource or workspace permissions.
The correct configuration is to assign User1 the Reader role on the resource group RG-Prod and configure the workspace to use resource or workspace permissions. This ensures resource-context access is enabled. With this setting, users can query log data for resources they have read access to, without needing access to the workspace itself. This restricts the user from seeing logs for virtual machines in other resource groups.

Step-by-Step Solution

1
Determine the access model required for User1.
User1 must only view logs for resources within RG-Prod. This requires resource-context access, where access is determined by permissions on individual resources rather than the workspace.
Workspace-context access exposes all log data within the workspace, which would violate the constraint.
2
Select the correct Access Control Mode for the Log Analytics workspace.
Configure Workspace1 to use 'Use resource or workspace permissions'.
This is the default setting that enables resource-context access.
3
Assign the appropriate RBAC role to User1 at the correct scope.
Assign the Reader role to User1 on the resource group RG-Prod.
Having read permissions on the resource group allows the user to query logs for all virtual machines within that resource group using KQL.

Key Concept

Log Analytics Access Control Modes (Resource-context vs Workspace-context)
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic