Examkin

Question

Difficulty: HardMonitoring and Log Routing Solutions

An enterprise has Azure workloads deployed in the Australia East and Japan East regions. You are designing a monitoring and log routing solution that must satisfy the following requirements:

* Data Sovereignty: All diagnostic and activity logs generated by resources in Australia East must remain stored within Australia. All logs generated in Japan East must remain stored within Japan.
* Central Security Operations: A global security team based in the United States must have a unified, real-time interface to run security analytics and threat-hunting queries using Microsoft Sentinel across all regional logs.
* Operational Access: Regional operations teams must only access diagnostic logs and performance metrics for the resources they manage within their respective regions.
* Governance and Security: Access controls must follow the principle of least privilege and be managed at scale using security groups.

Which log routing and workspace architecture should you recommend?

  1. Deploy a Log Analytics workspace in Australia East and another in Japan East, enabling Microsoft Sentinel on both workspaces. Configure diagnostic settings to route regional logs to their respective local workspaces. Grant the global security team permissions to run cross-workspace queries. Assign the regional operations teams to Microsoft Entra ID groups and assign these groups the Reader role at the resource group scope to enable resource-context log access.Answer
  2. B
    Deploy a single centralized Log Analytics workspace in the East US region and enable Microsoft Sentinel on it. Configure all diagnostic settings in Australia East and Japan East to route logs to this centralized workspace, and grant workspace-level Reader access to the regional operations teams.
  3. C
    Deploy a Log Analytics workspace in Australia East and another in Japan East, enabling Microsoft Sentinel on both. Configure diagnostic settings to route regional resource logs to their local workspaces. For the regional operations teams, assign the Reader role directly to each individual user account on the regional Log Analytics workspace to restrict their access to that specific region's logs.
  4. D
    Deploy a Log Analytics workspace in Australia East and another in Japan East, enabling Microsoft Sentinel on both. Configure Azure Policy with a Deny effect to block the deployment of any resources in Australia East and Japan East unless they are configured to route diagnostic logs to a centralized Log Analytics workspace in the East US region.

Answer

Deploy regional Log Analytics workspaces in Australia East and Japan East with Microsoft Sentinel enabled on both, route logs locally, configure cross-workspace queries for the global security team, and use Microsoft Entra ID groups with resource-context RBAC for regional operations teams.
The correct solution deploys two separate regional Log Analytics workspaces (in Australia East and Japan East) to enforce regional data residency constraints. Microsoft Sentinel is enabled on both regional workspaces to allow the US-based security team to run cross-workspace queries, securing a single pane of glass without migrating the actual log data out of its region of origin. Finally, it uses Entra ID groups mapped to resource group scopes, allowing regional operations teams to view logs of resources they own using resource-context access without giving them access to other resources or the workspace itself.

Step-by-Step Solution

1
Evaluate data sovereignty constraints.
Logs must remain within their originating regions (Australia East and Japan East). This rules out centralizing all raw log storage in a single US-based Log Analytics workspace.
To satisfy regional compliance, separate regional Log Analytics workspaces must be deployed in Australia East and Japan East.
2
Address central security monitoring requirements.
Enable Microsoft Sentinel on both regional workspaces and grant the global security team access to run cross-workspace queries.
Microsoft Sentinel allows querying across multiple workspaces. This allows the security team in the US to perform unified threat hunting while the raw logs remain resident in their respective regions.
3
Configure operational access control.
Assign the regional operations teams to Microsoft Entra security groups and assign those groups the Reader role at the resource group level.
Using group-based assignments instead of direct user assignments follows administrative best practices. Granting permissions at the resource group level enables resource-context log access, allowing operators to query logs of their resources without seeing all workspace data.

Key Concept

Designing a compliant log routing architecture that balances regional data residency, centralized SIEM visibility, and resource-context RBAC governance.
Rate this question

Topics

Monitoring and Log Routing Solutions