Examkin

Question

Difficulty: MediumLog Analytics Workspaces and KQL Queries

You have an Azure subscription that contains a Log Analytics workspace named Workspace1. Workspace1 is configured with the 'Require workspace permissions' access control mode. The subscription contains an Azure Key Vault named KeyVault1 and a virtual machine named VM1, both of which send their diagnostics to Workspace1. A user named User1 needs to run KQL queries to monitor KeyVault1 and VM1. User1 has the Reader role on both KeyVault1 and VM1, but currently has no access to Workspace1. When User1 attempts to query logs, no data is returned. You need to ensure User1 can query the diagnostics logs. Which two actions should you perform?

  1. Configure Workspace1 to use resource or workspace permissions.Answer
  2. Assign the Log Analytics Reader role on Workspace1 to User1.Answer
  3. C
    Configure Workspace1 to require workspace permissions only.
  4. D
    Assign the Monitoring Reader role on KeyVault1 and VM1 to User1.

Answer

Configure the Log Analytics workspace to use resource or workspace permissions, and assign the Log Analytics Reader role on the workspace to the user.
Configuring the workspace to use resource or workspace permissions enables resource-context access, which allows the user to query logs for the specific resources they have permissions for (KeyVault1 and VM1). Alternatively, assigning the Log Analytics Reader role directly on the workspace grants workspace-context access, allowing the user to query all data in the workspace regardless of resource-level settings.

Step-by-Step Solution

1
Analyze the current permissions of the user and the configuration of the Log Analytics workspace.
The user has Reader access to the target resources but no permissions on the workspace. The workspace requires workspace permissions, preventing resource-context access.
To identify why the user cannot see the logs and determine the path to resolve it.
2
Evaluate the option to grant workspace-context access.
Assigning the Log Analytics Reader role to the user on the workspace allows them to run KQL queries on all data in the workspace.
To provide direct workspace access permissions to the user.
3
Evaluate the option to enable resource-context access.
Configuring the workspace to 'Use resource or workspace permissions' allows users with access to the source resources to query their logs without needing workspace-level permissions.
To leverage the user's existing resource-level Reader permissions.

Key Concept

Log Analytics Workspace access control modes govern how users are authorized to read log data. Workspace-context access requires permissions on the workspace itself (e.g., Log Analytics Reader). Resource-context access allows users to view logs for resources they have access to, provided the workspace is configured to use resource or workspace permissions.
Estimated Time:1m 30s
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic