Examkin

Question

Difficulty: EasyMonitoring and Log Routing Solutions

An organization has two departments, Finance and HR, that run workloads in separate Azure subscriptions. Regulatory compliance requires that HR administrators must not have access to Finance security logs, and Finance administrators must not have access to HR security logs. You need to design an Azure Monitor log routing architecture that enforces this boundary. Which architecture should you recommend?

  1. Create separate Log Analytics workspaces for the Finance and HR subscriptions, and route the diagnostic logs of each subscription to its respective workspace.Answer
  2. B
    Deploy a single centralized Log Analytics workspace, route logs from both subscriptions to this workspace, and configure workspace-level access control permissions.
  3. C
    Deploy separate Log Analytics workspaces for each department, and assign the Log Analytics Reader role directly to individual administrator user accounts.
  4. D
    Create separate Log Analytics workspaces for each department, and use an Azure Policy with a Deny effect to deploy diagnostic settings automatically for all new resources.

Answer

Create separate Log Analytics workspaces for the Finance and HR subscriptions, and route the diagnostic logs of each subscription to its respective workspace.
Creating separate Log Analytics workspaces for the Finance and HR subscriptions ensures that log data is stored in isolated repositories. This satisfies the strict regulatory compliance requirement by preventing cross-department access to security logs, as workspace-level permissions can be restricted to authorized personnel of each department.

Step-by-Step Solution

1
Identify the data isolation and compliance requirements between the two departments.
HR and Finance departments require strict administrative isolation of security logs, meaning neither can access the other's logs.
This establishes the core design boundary where separate administrative access controls are mandatory.
2
Determine the appropriate workspace boundary in Azure Monitor.
Since Log Analytics workspaces serve as the primary administrative and security boundary for logs, separate workspaces must be deployed.
A single centralized workspace cannot easily enforce strict isolation without complex table-level RBAC, which is prone to configuration error and may not satisfy strict compliance audits.
3
Select the correct routing and governance mechanism.
Configure diagnostic settings to route subscription logs to their respective workspaces, using DeployIfNotExists policies for automation.
This ensures compliance is maintained automatically and securely without relying on manual configuration or direct individual RBAC assignments.

Key Concept

Log Analytics Workspace as an Administrative Boundary
Rate this question

Topics

Monitoring and Log Routing Solutions