Examkin

Question

Difficulty: HardMonitoring and Log Routing Solutions

A company has Azure workloads deployed across the East US and North Europe regions. Regulatory compliance mandates that log data originating from North Europe must remain within the European Union (EU) boundaries. The security team must be able to perform central security analytics across all regions using Microsoft Sentinel. Regional operations teams must only access logs from their respective regions. Furthermore, the configuration of diagnostic log routing to the correct regional destination must be automated for all new resources to minimize administrative overhead. Which architecture should you design to meet the requirements?

  1. Deploy two Log Analytics workspaces: one in East US and one in North Europe. Enable Microsoft Sentinel on both workspaces. Configure Azure Policy with a DeployIfNotExists effect to automatically route diagnostic logs to the local workspace in each region, and assign access using Microsoft Entra ID groups.Answer
  2. B
    Deploy a single centralized Log Analytics workspace in East US. Enable Microsoft Sentinel on the workspace. Configure Azure Policy with a DeployIfNotExists effect to route all diagnostic logs to this centralized workspace, and assign access using Microsoft Entra ID groups.
  3. C
    Deploy two Log Analytics workspaces: one in East US and one in North Europe. Enable Microsoft Sentinel on both workspaces. Configure Azure Policy with a DeployIfNotExists effect to route diagnostic logs to the local workspace in each region, and assign access permissions directly to individual regional user accounts.
  4. D
    Deploy two Log Analytics workspaces: one in East US and one in North Europe. Enable Microsoft Sentinel on both workspaces. Configure Azure Policy with a Deny effect to block the deployment of resources that do not have active diagnostic log routing configured, and assign access using Microsoft Entra ID groups.

Answer

Deploy two Log Analytics workspaces (one in East US and one in North Europe) with Sentinel enabled, configure Azure Policy with a DeployIfNotExists effect to automate regional log routing, and manage access using Microsoft Entra ID groups.
The correct architecture uses separate workspaces in East US and North Europe to comply with data residency regulations. It automates diagnostic configuration using a DeployIfNotExists Azure Policy, which configures log routing without blocking deployments. Finally, it delegates access using Microsoft Entra ID groups, satisfying the requirement to minimize administrative overhead.

Step-by-Step Solution

1
Determine workspace placement based on data residency requirements.
Two separate workspaces are required (East US and North Europe) because North Europe logs must remain within EU boundaries.
Data residency regulations dictate that logs cannot cross geographical boundaries, preventing a single centralized US workspace.
2
Determine the mechanism to automate the configuration of diagnostic log routing.
Azure Policy with a DeployIfNotExists (DINE) effect should be used.
DINE automatically creates diagnostic settings on new resources to route logs to the local workspace without interrupting the resource deployment workflow.
3
Determine the access control mechanism for regional administrators.
Assign Workspace Reader permissions using Microsoft Entra ID groups mapped to the workspaces.
Assigning RBAC permissions to groups instead of individual users simplifies administration and aligns with standard governance guidelines.

Key Concept

Designing compliant, automated, and secure multi-region log routing and workspace architectures in Azure.
Rate this question

Topics

Monitoring and Log Routing Solutions