An organization has workloads deployed in the East US and North Europe regions. Regulatory requirements mandate that log data generated in North Europe must reside and be stored within North Europe to comply with data sovereignty regulations. Similarly, logs from East US must remain in the United States. A centralized security audit team based in the United States requires the ability to run ad-hoc compliance queries across the log data of both regions.
You need to design a monitoring and log routing architecture that satisfies these requirements.
Which two configurations should you include in the design?
- A Log Analytics workspace in the East US region and a separate Log Analytics workspace in the North Europe region to host logs locally.Answer
- Cross-workspace queries in Azure Monitor to allow the security audit team to query data across both workspaces.Answer
- CA single, centralized Log Analytics workspace located in the East US region to collect logs from both regions.
- DAn Azure Event Hubs namespace deployed in the East US region as the sole consolidation point for log ingestion.
- EAn Azure Policy configured with the Deny effect to block any resource deployment that does not direct logs to the US-based workspace.
Answer
To satisfy the requirements, deploy a Log Analytics workspace in the East US region and a separate Log Analytics workspace in the North Europe region to host logs locally, and configure cross-workspace queries in Azure Monitor to allow the security audit team to query data across both workspaces.
Deploying separate Log Analytics workspaces in the East US and North Europe regions ensures that log data is stored locally within its respective region, satisfying data residency regulations. Enabling cross-workspace queries allows the centralized security audit team to run Kusto Query Language (KQL) queries across both workspaces from a single pane of glass without violating sovereignty, as the data itself is not permanently relocated.
Step-by-Step Solution
Key Concept
Designing regional Log Analytics workspaces to meet data sovereignty requirements while enabling centralized querying via cross-workspace queries.
Estimated Time:2m 0s