Examkin

Question

Difficulty: HardMonitoring and Log Routing Solutions

A multinational manufacturing company operates workloads in the Germany West Central and East US regions. The compliance and security teams mandate the following requirements:
- Virtual machine resource logs must be stored regionally to comply with strict data residency laws, and regional operations teams must only access logs generated within their respective region.
- Diagnostic logs of Azure Key Vaults containing cryptographic keys must be retained for at least 7 years in a tamper-proof state.
- Azure Activity logs and Microsoft Entra ID sign-in logs must be forwarded to a third-party SIEM tool located in the on-premises datacenter.
- Administrative access to monitoring settings must be automatically enforced for new resources, and role assignments must scale without administrative overhead.

Which two components or configurations should you include in the log routing and monitoring design?

  1. An Azure Event Hubs namespace to stream Azure Activity and Microsoft Entra ID sign-in logs to the on-premises SIEM.Answer
  2. An Azure Storage account configured with a time-based retention immutability policy to store Key Vault diagnostic logs.Answer
  3. C
    A single centralized Log Analytics workspace located in Germany West Central to store all virtual machine resource logs, using resource-context Role-Based Access Control (RBAC) to enforce regional boundaries.
  4. D
    An Azure Policy definition with the Deny effect to automatically configure diagnostic settings for all newly created virtual machines.
  5. E
    Direct assignment of the monitoring reader permissions to individual regional administrators' Microsoft Entra ID accounts to simplify access management.

Answer

An Azure Event Hubs namespace to stream Azure Activity and Microsoft Entra ID sign-in logs to the on-premises SIEM, and an Azure Storage account configured with a time-based retention immutability policy to store Key Vault diagnostic logs.
Streaming logs to an external SIEM is achieved by configuring Azure Monitor diagnostic settings to point to an Azure Event Hubs namespace. Key Vault diagnostic logs require a 7-year tamper-proof period, which is met by using an Azure Storage account configured with a time-based retention immutability policy (WORM).

Step-by-Step Solution

1
Select the log forwarding mechanism for the third-party on-premises SIEM.
Identify Azure Event Hubs as the standard routing destination.
Azure Monitor diagnostic settings integrate natively with Azure Event Hubs to stream log data in real-time to third-party consumer tools and on-premises SIEMs.
2
Select the storage mechanism for the 7-year tamper-proof Key Vault logs.
Identify Azure Storage with an immutability policy.
To satisfy long-term retention and WORM (write-once-read-many) compliance, Azure Storage offers time-based retention immutability policies that lock the data against deletion or overwriting.
3
Verify isolation and residency requirements for Virtual Machine logs.
Reject the single centralized Log Analytics workspace design.
Data sovereignty and data residency requirements require separate regional Log Analytics workspaces (Germany West Central and East US) so logs do not cross geopolitical boundaries.
4
Ensure scalable administration and correct policy configurations.
Reject direct user RBAC assignments and Deny policy effects.
RBAC permissions should be assigned to groups rather than individual users to scale administrative operations. Policy effects should be DeployIfNotExists to configure diagnostic settings rather than Deny, which merely blocks resource deployment.

Key Concept

Designing compliant Azure Monitor diagnostic log routing, regional data residency boundaries, and immutable long-term storage.
Rate this question

Topics

Monitoring and Log Routing Solutions