Examkin

Question

Difficulty: EasyMonitoring and Log Routing Solutions

An organization has Azure resources deployed in both the United States and the European Union (EU). Legal compliance regulations require that all logs generated by EU resources remain stored within the EU, while US resource logs must reside in the US. Additionally, administrators must only access logs for their respective regions.

Which log routing and storage solution should you design to meet these requirements?

  1. A
    Deploy a single central Log Analytics workspace in the US, route all resource logs to it, and use Azure RBAC to restrict access based on the resource origin.
  2. B
    Deploy a single central Log Analytics workspace and use Azure Policy with a Deny effect to block resource logs from being routed across regional boundaries.
  3. Deploy one Log Analytics workspace in the US and a separate Log Analytics workspace in the EU, route the respective resource logs to each workspace, and manage access using Microsoft Entra ID groups.Answer
  4. D
    Deploy one Log Analytics workspace in the US and a separate Log Analytics workspace in the EU, route the respective logs to each, and assign log reader permissions directly to individual administrator user accounts.

Answer

Deploy one Log Analytics workspace in the US and a separate Log Analytics workspace in the EU, route the respective resource logs to each workspace, and manage access using Microsoft Entra ID groups.
The correct solution requires deploying separate Log Analytics workspaces in the US and the EU to satisfy the regional data residency requirements. Routing each region's resource logs to its local workspace keeps the data within the required boundaries. Managing workspace access via Microsoft Entra ID groups ensures secure, administrative segregation with minimal management overhead, aligning with Azure best practices.

Step-by-Step Solution

1
Analyze data residency constraints.
Identified that EU logs must be stored in the EU, and US logs must be stored in the US. This necessitates deploying separate Log Analytics workspaces in each region.
A single workspace cannot store data across different geographical regions simultaneously due to workspace region binding.
2
Configure log routing.
Configure Diagnostic Settings on resources in each region to route logs to their corresponding regional Log Analytics workspace.
Diagnostic settings determine the destination workspace for resource log streams.
3
Configure access control using best practices.
Assign Log Analytics Reader roles to Microsoft Entra ID groups representing US and EU administrators respectively.
Using groups for role assignment reduces administrative overhead compared to direct individual user assignments.

Key Concept

Data residency compliance and administrative isolation in Azure Monitor log routing design.
Estimated Time:1m 30s
Rate this question

Topics

Monitoring and Log Routing Solutions