Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

An international company hosts application workloads in Azure across two regions: East US and North Europe. The company's compliance policy dictates that all log data must remain within the region where it was generated. You need to design a monitoring and log routing solution that automatically configures diagnostic logging for newly deployed resources, complies with regional data residency, and minimizes administrative overhead for user access management. Which of the following configurations should you include in the design? (Select TWO.)

  1. Deploy a separate Log Analytics workspace in East US and another in North Europe to store logs generated within each respective region.Answer
  2. Create Azure Policy assignments with the DeployIfNotExists effect to automatically configure diagnostic settings for new resources to route to the regional workspaces.Answer
  3. C
    Deploy a single centralized Log Analytics workspace in East US and route logs from both regions to it.
  4. D
    Create Azure Policy assignments with the Deny effect to block the deployment of resources that do not have diagnostic settings configured.
  5. E
    Assign the Monitoring Reader role directly to individual user accounts of the monitoring team.

Answer

Deploy a separate Log Analytics workspace in East US and another in North Europe, and create Azure Policy assignments with the DeployIfNotExists effect.
Deploying regional Log Analytics workspaces ensures compliance with regional data residency constraints. Using Azure Policy with the DeployIfNotExists effect ensures that new resources automatically have diagnostic logging configured without manual intervention or deployment failures.

Step-by-Step Solution

1
Analyze the regional data residency requirement.
Determine that a single centralized workspace in East US is not compliant because logs generated in Europe would cross boundaries, necessitating regional workspaces.
Data residency mandates keeping logs local to the generating region.
2
Address the requirement to automatically configure diagnostic settings on newly deployed resources.
Select Azure Policy with a DeployIfNotExists effect to automatically configure diagnostic logging rather than a Deny policy which blocks creation.
DeployIfNotExists automates remediation during deployment, satisfying the requirement to automatically configure logging.
3
Evaluate access management overhead.
Avoid assigning roles directly to individual users to minimize management overhead, pointing out that RBAC roles should be assigned to groups.
Group-based role assignment scales administrative access management.

Key Concept

Designing regional log storage compliance and automated log routing configuration using Azure Policy.
Rate this question

Topics

Monitoring and Log Routing Solutions