Examkin

Question

Difficulty: Very hardMonitoring and Log Routing Solutions

A global financial technology enterprise is designing a logging and auditing architecture for a new payment processing platform. The platform is deployed across two Azure regions: France Central (primary) and Qatar Central (secondary).

The compliance department mandates the following strict constraints:
1. Administrative and operational log data from France Central must remain within the European Union (EU) borders to satisfy regional sovereignty laws, while logs from Qatar Central must be stored within the Middle East region.
2. Data security policies require that developers can only query logs for resources they are explicitly authorized to manage, without having read access to the underlying Log Analytics workspace settings or other workloads' logs.
3. Diagnostic logging configuration must be automatically enforced and deployed for all current and future Azure SQL databases and App Service instances within the target subscriptions.
4. The architectural design must minimize overall Log Analytics workspace operational overhead while satisfying all regulatory boundaries.

Which log routing and workspace configuration strategy should you recommend to meet these requirements?

  1. Deploy two regional Log Analytics workspaces: one in France Central and one in Qatar Central. Configure resource-context access control on both workspaces. Authorize developers using Microsoft Entra groups assigned to the target resource groups. Enforce the diagnostic settings across subscriptions using an Azure Policy with the DeployIfNotExists effect.Answer
  2. B
    Deploy a single centralized Log Analytics workspace in France Central. Configure workspace-context access control on the workspace, and assign access to developers using Microsoft Entra groups. Automatically apply diagnostic settings using an Azure Policy with the Deny effect.
  3. C
    Deploy two regional Log Analytics workspaces: one in France Central and one in Qatar Central. Configure workspace-context access control on both workspaces, and assign Reader permissions on the workspaces directly to the individual developer user accounts. Enforce diagnostic settings using an Azure Policy with the DeployIfNotExists effect.
  4. D
    Deploy separate Log Analytics workspaces for each individual application workload in both France Central and Qatar Central. Configure resource-context access control and assign permissions to developers via Microsoft Entra groups. Automatically apply diagnostic settings using an Azure Policy with the Deny effect.

Answer

Deploy two regional Log Analytics workspaces (one in France Central and one in Qatar Central) with resource-context access control, assign permissions using Microsoft Entra groups at the resource group level, and use an Azure Policy with the DeployIfNotExists effect to automate diagnostic settings.
The correct solution recommends regional workspaces to meet strict data sovereignty requirements, since Log Analytics workspace data remains in the region where the workspace is created. Using resource-context access control ensures that developers can only query logs for resources they are authorized to manage, without workspace-level permissions. Assigning RBAC roles to Microsoft Entra groups is the standard best practice for scalable management. Lastly, an Azure Policy with the DeployIfNotExists effect automatically creates diagnostic settings for new and existing resources, ensuring automated compliance without blocking deployments.

Step-by-Step Solution

1
Analyze data residency and sovereignty requirements
Two regional Log Analytics workspaces are required because workspace data is bound to the region of deployment. A single workspace in France Central would violate Middle East data residency for Qatar Central resources.
Log Analytics workspaces store data in the region they are provisioned, so separate workspaces are required to comply with regional sovereignty constraints.
2
Determine the workspace access model
Resource-context access control must be configured.
Resource-context access allows users to query logs only for resources they have RBAC access to, preventing them from viewing logs of other workloads or accessing workspace settings, without requiring separate workspaces per workload.
3
Design the identity and access management (IAM) structure
Permissions must be assigned to Microsoft Entra groups mapped to the target resource groups, rather than assigning permissions directly to user accounts or workspaces.
Assigning RBAC roles to groups at the resource group level ensures scalability, compliance with security best practices, and clean separation of duties.
4
Select the policy automation mechanism
An Azure Policy with the DeployIfNotExists effect is chosen.
DeployIfNotExists automatically deploys and configures the diagnostic settings on non-compliant resources, whereas a Deny policy would block developers from deploying resources altogether if they did not manually specify diagnostic settings.

Key Concept

Designing a compliant, secure, and low-overhead log routing architecture using regional Log Analytics workspaces, resource-context access control, group-based RBAC, and DeployIfNotExists Azure Policies.
Rate this question

Topics

Monitoring and Log Routing Solutions