Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

A healthcare provider hosts a telehealth application with Azure resources deployed in both the East US and West Europe regions. To satisfy regulatory requirements, diagnostic logs from the West Europe resources must be stored strictly within the European Union, while logs from East US resources must reside within the United States. The access to these logs must be restricted to regional auditing teams, and administrative management overhead for the monitoring infrastructure must be minimized. Which log routing and workspace configuration should you recommend to meet these requirements?

  1. Deploy one Log Analytics workspace in West Europe and another in East US, configure diagnostic settings on regional resources to route to their respective local workspaces, and assign log access permissions to regional auditor groups using Microsoft Entra ID groups.Answer
  2. B
    Deploy a single centralized Log Analytics workspace in East US, configure diagnostic settings on all regional resources to route logs to this workspace, and use resource-context Azure RBAC to restrict European auditors to West Europe resource logs.
  3. C
    Deploy one Log Analytics workspace in West Europe and another in East US, configure diagnostic settings on regional resources to route to their respective local workspaces, and assign the Monitoring Reader role directly to the individual Azure user accounts of each regional auditor.
  4. D
    Deploy one Log Analytics workspace in West Europe and another in East US, and apply an Azure Policy with a Deny effect to automatically deploy and configure diagnostic settings for all newly created resources to route to the correct regional workspace.

Answer

Deploy one Log Analytics workspace in West Europe and another in East US, configure diagnostic settings on regional resources to route to their respective local workspaces, and assign log access permissions to regional auditor groups using Microsoft Entra ID groups.
The correct architecture requires separate Log Analytics workspaces in West Europe and East US to adhere to strict data residency and sovereignty requirements, as data in Log Analytics resides within the workspace's region. Access control is managed cleanly and securely by assigning the required permissions to Microsoft Entra ID groups representing the regional auditors rather than individual users.

Step-by-Step Solution

1
Analyze data residency and sovereignty requirements.
Identified that logs from the West Europe region must reside in the EU, and logs from the East US region must reside in the US. This necessitates deploying at least two separate Log Analytics workspaces, one in each region, to maintain data residency compliance.
Log Analytics workspaces store data in the region where the workspace is created; logs cannot be consolidated into a single workspace if geographic segregation is legally required.
2
Evaluate access management and governance best practices.
Determined that access should be granted to groups of regional auditors rather than individual users to keep management scalable.
Assigning Azure RBAC permissions to Microsoft Entra ID groups instead of individual user accounts minimizes administrative overhead and aligns with the principle of least privilege and scalability.
3
Select the correct deployment mechanism for configuring diagnostic settings.
Rejected using a Deny policy effect for automatic deployment, noting that DeployIfNotExists is the correct policy effect for auto-configuring diagnostics.
Deny effect will prevent resource creation if settings are missing, whereas DeployIfNotExists will automatically provision the diagnostic settings upon deployment.

Key Concept

Designing compliant Azure Monitor architectures that respect data residency rules and follow Microsoft Entra ID RBAC best practices.
Rate this question

Topics

Monitoring and Log Routing Solutions