Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

An enterprise has Azure resources deployed in the East US and West Europe regions. To meet regulatory requirements, resource diagnostic logs from West Europe must remain within the European Union (EU) borders, while logs from East US must reside within the United States. Regional administrators must be able to query logs for their respective regions only, while a global security audit team requires access to all logs across both regions. You need to design the Azure Monitor log architecture to support this configuration with minimum administrative overhead. Which two configurations should you include in the design?

  1. Create one Log Analytics workspace in the East US region and a second Log Analytics workspace in the West Europe region.Answer
  2. B
    Create a single centralized Log Analytics workspace in the East US region and use resource-context RBAC to control access.
  3. Assign the regional administrators to region-specific Microsoft Entra groups, and assign those groups the Log Analytics Reader role on the respective regional workspace.Answer
  4. D
    Assign the Log Analytics Reader role directly to each regional administrator's user account on their respective regional workspace.
  5. E
    Implement an Azure Policy with a Deny effect to automatically configure and deploy diagnostic settings for newly created resources.

Answer

To meet the requirements, create regional Log Analytics workspaces in East US and West Europe, and manage permissions using regional Microsoft Entra groups assigned to the Log Analytics Reader role on their respective workspaces.
To comply with data residency regulations, diagnostic logs must be stored in the respective region of origin. Thus, separate workspaces in East US and West Europe are required. Additionally, to minimize administrative overhead and follow security best practices, access management should use Microsoft Entra groups rather than direct role assignments to individual user accounts.

Step-by-Step Solution

1
Determine the required number and locations of Log Analytics workspaces based on data residency.
Two workspaces are required: one in East US and one in West Europe to ensure EU logs do not leave the EU boundary.
Log Analytics workspace data residency is bound to the region where the workspace itself is deployed.
2
Determine the access model and delegation mechanism for the regional administrators.
Create Microsoft Entra groups for each region and assign the Log Analytics Reader role at the workspace scope.
Group-based RBAC assignments are recommended to minimize administrative overhead compared to individual user assignments.
3
Evaluate compliance automation alternatives for diagnostic settings deployment.
Avoid Deny policies for automatic deployment; instead, prepare DeployIfNotExists policies.
Deny blocks deployments but does not perform remediation or configuration actions.

Key Concept

Designing compliant, regional Azure Monitor Log Analytics workspace architectures and secure access controls using group-based RBAC.
Rate this question

Topics

Monitoring and Log Routing Solutions