Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

A multinational enterprise runs application workloads in the East US and Germany West Central regions. The German operations collect diagnostic logs containing metadata subject to strict European Union data sovereignty regulations, which mandate that all telemetry must remain resident within Germany. To manage these environments, the enterprise requires automated configuration of diagnostic logging for new resources, and the German security auditing team must be granted exclusive access to the German log files.

Which design strategy should you recommend to meet these requirements?

  1. Deploy separate Log Analytics workspaces in East US and Germany West Central, configure resources to route diagnostic logs to their local regional workspace, and manage access for the German auditors using Microsoft Entra security groups mapped to workspace roles.Answer
  2. B
    Deploy a single centralized Log Analytics workspace in East US, route all diagnostic and operational logs from both regions to it, and grant the German auditors workspace-level permissions.
  3. C
    Deploy separate Log Analytics workspaces in East US and Germany West Central, and assign an Azure Policy with the Deny effect to prevent deployments of resources that lack active diagnostic settings targeting these workspaces.
  4. D
    Deploy separate Log Analytics workspaces in East US and Germany West Central, configure local log routing, and assign the Log Analytics Reader role directly to the individual Azure user accounts of the German auditors.

Answer

Deploy separate Log Analytics workspaces in East US and Germany West Central, configure resources to route diagnostic logs to their local regional workspace, and manage access for the German auditors using Microsoft Entra security groups mapped to workspace roles.
The correct strategy deploys separate regional workspaces to satisfy European Union data sovereignty laws by keeping German operational data inside Germany. Furthermore, managing workspace access through Microsoft Entra security groups rather than individual account assignments aligns with identity governance best practices.

Step-by-Step Solution

1
Analyze data residency requirements.
Identified that EU data sovereignty regulations require German resource logs to remain within the Germany West Central region.
Data residency dictates physical workspace separation, precluding a single centralized workspace in East US.
2
Determine the proper governance approach for log configuration.
Determined that Azure Policy with 'DeployIfNotExists' is appropriate to automate diagnostic configurations, rather than blocking deployments using the 'Deny' effect.
Automating configuration ensures compliance without halting resource provisioning.
3
Design the access control model for security auditors.
Assigned workspace roles to a Microsoft Entra ID security group rather than directly to individual user accounts.
Group-based assignment reduces administrative overhead and aligns with Microsoft identity governance best practices.

Key Concept

Designing compliant Azure Monitor architectures that balance data residency regulations, policy-driven automation, and secure identity delegation.
Estimated Time:1m 30s
Rate this question

Topics

Monitoring and Log Routing Solutions