Examkin

Question

Difficulty: Very hardMonitoring and Log Routing Solutions

A multinational enterprise has workloads deployed in the East US and West Europe Azure regions. The enterprise must design a monitoring and log routing architecture that meets the following requirements:
1. All security logs must be analyzed using Microsoft Sentinel.
2. Data residency regulations dictate that logs generated by resources in West Europe must not leave the West Europe region.
3. The Security Operations (SecOps) team must be able to query security logs across both regions from a single query interface.
4. Development teams must only access diagnostic logs for the specific resources they manage. They must not have access to security logs or logs of resources owned by other teams.
5. Workspace administrative overhead and the number of Log Analytics workspaces must be minimized.

Which monitoring and log routing configuration should you recommend?

  1. A
    Deploy a single centralized Log Analytics workspace in East US. Enable Microsoft Sentinel on this workspace. Route all diagnostic logs from both East US and West Europe to this workspace, and use resource-context Azure RBAC to restrict developer access to their specific resource logs.
  2. B
    Deploy separate Log Analytics workspaces in East US and West Europe for each development team's resources, and a separate pair of workspaces in both regions for Microsoft Sentinel. Configure workspace-context Azure RBAC for developers on their designated workspaces.
  3. Deploy one Log Analytics workspace in East US and one in West Europe. Enable Microsoft Sentinel on both workspaces, and query both workspaces centrally. Route resource diagnostic logs to these regional workspaces, and grant developers Read permissions on their specific Azure resources to enable resource-context log access.Answer
  4. D
    Deploy one Log Analytics workspace in East US and one in West Europe. Enable Microsoft Sentinel on both workspaces. Assign the Log Analytics Reader role directly to individual developer user accounts at the workspace level, and use an Azure Policy with a Deny effect to prevent deployment of resources without diagnostic settings.

Answer

Deploy one Log Analytics workspace in East US and one in West Europe. Enable Microsoft Sentinel on both workspaces, and query both workspaces centrally. Route resource diagnostic logs to these regional workspaces, and grant developers Read permissions on their specific Azure resources to enable resource-context log access.
The correct configuration establishes one regional Log Analytics workspace in East US and one in West Europe, which respects data residency requirements. By enabling Microsoft Sentinel on both, the SecOps team can query both workspaces centrally using cross-workspace queries. By granting developers Read permissions on their specific Azure resources, they can access their logs using resource-context RBAC. This avoids workspace sprawl and prevents unauthorized access to security logs or other resources' logs.

Step-by-Step Solution

1
Analyze regional data residency requirements.
Determined that at least two regional Log Analytics workspaces (one in East US and one in West Europe) must be deployed to ensure logs from West Europe do not leave the region.
Strict compliance guidelines require regional data sovereignty for West Europe resources.
2
Address the centralized security query requirement.
Configure Microsoft Sentinel on both workspaces and utilize cross-workspace querying capabilities to present a single pane of glass dashboard to SecOps.
Microsoft Sentinel supports querying across multiple workspaces within the same tenant, enabling centralized analysis without consolidating raw logs.
3
Design developer access control to logs.
Leverage resource-context Azure RBAC. Grant developers Read access to their specific resources instead of access to the workspace.
Resource-context RBAC allows users to query logs of resources they have read access to directly from the resource's blade or using resource-scoped queries, preventing access to logs of other resources or Sentinel security tables.
4
Minimize administrative overhead.
Consolidate to a single workspace per region for all resource logs instead of creating per-team or per-application workspaces.
Resource-context RBAC eliminates the need to isolate logs in separate workspaces for access control, minimizing workspace management overhead.

Key Concept

Designing a multi-region log routing architecture that balances regulatory data residency compliance, centralized security monitoring, and granular access control (resource-context RBAC) while minimizing workspace overhead.
Rate this question

Topics

Monitoring and Log Routing Solutions