Examkin

Question

Difficulty: HardMonitoring and Log Routing Solutions

A financial services company is establishing its presence in two Azure regions: Germany West Central and North Europe. The compliance department mandates that all logs containing customer financial data from the German region must remain within Germany to satisfy national data residency regulations. Workloads in North Europe have no data residency restrictions, and the company wants to optimize operational efficiency and reduce storage costs. Additionally, the security operations center requires that all newly created Azure Virtual Machines in both regions automatically configure their diagnostic logs to route to the designated Log Analytics workspaces without manual intervention. You need to design a monitoring, log routing, and access governance architecture that meets these requirements while adhering to Azure best practices.

Which architecture should you recommend?

  1. Deploy one Log Analytics workspace in Germany West Central and one Log Analytics workspace in North Europe. Create an Azure Policy using the DeployIfNotExists effect to automatically configure diagnostic settings for new virtual machines, and manage workspace access by assigning roles to Microsoft Entra security groups.Answer
  2. B
    Deploy a single centralized Log Analytics workspace in North Europe for all resources. Create an Azure Policy using the DeployIfNotExists effect to configure diagnostics, and use Azure RBAC to restrict access to German logs for operators outside Germany.
  3. C
    Deploy one Log Analytics workspace in Germany West Central and one Log Analytics workspace in North Europe. Create an Azure Policy using the Deny effect to block the creation of virtual machines that do not have diagnostic settings pre-configured, and manage workspace access using Microsoft Entra security groups.
  4. D
    Deploy one Log Analytics workspace in Germany West Central and one Log Analytics workspace in North Europe. Create an Azure Policy using the DeployIfNotExists effect to automatically configure diagnostic settings for new virtual machines, and grant regional operators access by assigning roles directly to their individual user accounts.

Answer

Deploy one Log Analytics workspace in Germany West Central and one Log Analytics workspace in North Europe. Create an Azure Policy using the DeployIfNotExists effect to automatically configure diagnostic settings for new virtual machines, and manage workspace access by assigning roles to Microsoft Entra security groups.
Deploying regional workspaces respects the local data residency requirement for German workloads. Using DeployIfNotExists automatically configures diagnostics for new VMs. Applying RBAC roles to Microsoft Entra security groups conforms to identity best practices.

Step-by-Step Solution

1
Analyze data residency constraints for the Germany West Central region.
Identify that a local Log Analytics workspace in Germany West Central is required to comply with national data sovereignty laws.
Log data containing customer financial data from Germany cannot be sent to North Europe due to regulatory restrictions, which rules out a single centralized workspace.
2
Determine the correct Azure Policy effect to automate diagnostic configuration on new Virtual Machines.
Select the DeployIfNotExists policy effect.
DeployIfNotExists automatically remediates non-compliant resources at deployment time by applying the diagnostic settings, whereas a Deny policy would block the deployment of VMs entirely.
3
Formulate the access governance model for the Log Analytics workspaces.
Establish Microsoft Entra security groups and assign Azure RBAC roles to them rather than individual accounts.
Assigning permissions directly to user accounts violates Azure Identity best practices for scalability and administrative management.

Key Concept

Designing regional vs centralized workspaces for regulatory compliance, automating resource configuration using DeployIfNotExists, and securing workspace access using Microsoft Entra group RBAC roles.
Rate this question

Topics

Monitoring and Log Routing Solutions