Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

An international retail company hosts containerized application workloads in Azure across the UK South and Southeast Asia regions. To meet governance and compliance requirements, you must design a monitoring and log routing solution that satisfies the following criteria:

- Data Residency: Diagnostic logs generated by resources in Southeast Asia must remain within Southeast Asia, and logs generated in UK South must remain within the UK.
- Access Control: Application development teams must only be able to view logs for their own resources, without being granted permissions to the underlying Log Analytics workspace or logs of other teams.
- Log Enforcement: All newly deployed resources must automatically have diagnostic settings configured to route logs to the appropriate workspace. Non-compliant deployments must be remediated automatically without blocking the resource provisioning process.

Which design strategy should you recommend?

  1. A
    Deploy a single global Log Analytics workspace in UK South. Configure resource-context access on the workspace, assign Reader roles on the resource groups to the development teams' Microsoft Entra ID groups, and assign an Azure Policy with a DeployIfNotExists effect.
  2. Deploy one Log Analytics workspace in UK South and one in Southeast Asia. Enable resource-context access on both workspaces, assign Reader roles on the resource groups to the development teams' Microsoft Entra ID groups, and assign an Azure Policy with a DeployIfNotExists effect.Answer
  3. C
    Deploy one Log Analytics workspace in UK South and one in Southeast Asia. Enable workspace-context access on both workspaces, assign Reader roles on the workspaces directly to the individual developer user accounts, and assign an Azure Policy with a DeployIfNotExists effect.
  4. D
    Deploy one Log Analytics workspace in UK South and one in Southeast Asia. Enable resource-context access on both workspaces, assign Reader roles on the resource groups to the development teams' Microsoft Entra ID groups, and assign an Azure Policy with a Deny effect.

Answer

Deploy one Log Analytics workspace in UK South and one in Southeast Asia. Enable resource-context access on both workspaces, assign Reader roles on the resource groups to the development teams' Microsoft Entra ID groups, and assign an Azure Policy with a DeployIfNotExists effect.
The correct strategy uses separate Log Analytics workspaces in UK South and Southeast Asia to meet regional data residency constraints. Enabling resource-context access and assigning resource-group level Reader permissions to Microsoft Entra ID groups ensures that developers can only query logs for resources they own, following security best practices. The DeployIfNotExists Azure Policy automatically deploys diagnostic settings for new resources, achieving compliance without interrupting the deployment workflow.

Step-by-Step Solution

1
Determine workspace layout for data residency.
Logs must stay within their respective regions, so separate workspaces are required in UK South and Southeast Asia.
A single global workspace would cause Southeast Asia log data to be exported to UK South, violating regional residency rules.
2
Determine Azure Policy effect for automatic enforcement.
Use the DeployIfNotExists policy effect to automatically configure diagnostic settings.
The DeployIfNotExists effect automatically deploys diagnostic settings for new resources without blocking the deployment, whereas a Deny effect would block provisioning if settings are not defined in the deployment template.
3
Determine RBAC and access control configuration.
Enable resource-context access on the workspaces and assign Reader roles on the resource groups to the teams' Microsoft Entra ID groups.
Resource-context access allows developers to query logs of resources they have access to without workspace administrative permissions. Using Entra ID groups aligns with RBAC best practices instead of assigning roles to individual accounts.

Key Concept

Designing regional log routing, access control via resource-context RBAC, and policy-driven log enforcement.
Rate this question

Topics

Monitoring and Log Routing Solutions