Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

An organization is designing a log routing and monitoring solution for application workloads deployed across two Azure regions: West US and North Europe. The design must meet the following requirements:
- Logs containing personally identifiable information (PII) from resources in North Europe must remain within the European Union (EU) to comply with data sovereignty regulations.
- Any newly deployed resource must be automatically configured to route its diagnostic logs without manual intervention.
- The monitoring logs must be retained for seven years, minimizing costs for long-term storage.
- Administrative access must follow the principle of least privilege, ensuring European operators can only access European logs, while central administrators can query logs across both regions.

Which two configurations should you include in the monitoring design?

  1. Deploy separate Log Analytics workspaces in West US and North Europe, and route diagnostic logs to regional Azure Storage accounts with lifecycle policies.Answer
  2. Configure an Azure Policy definition with the DeployIfNotExists effect to remediate resources by deploying diagnostic settings automatically.Answer
  3. C
    Deploy a single centralized Log Analytics workspace in West US to collect logs from both regions and simplify administration.
  4. D
    Configure an Azure Policy definition with the Deny effect to block the deployment of any resource that does not have diagnostic settings configured.
  5. E
    Assign the Log Analytics Reader role directly to the individual Microsoft Entra user accounts of the European operators on the North Europe workspace.

Answer

Deploy separate Log Analytics workspaces in West US and North Europe with Azure Storage accounts for long-term retention, and configure an Azure Policy definition with the DeployIfNotExists effect to automate diagnostic settings.
The solution requires separate regional Log Analytics workspaces to satisfy regional data residency and administrative isolation constraints. Using Azure Storage accounts with lifecycle management provides the most cost-efficient way to retain logs for seven years. Automated provisioning of diagnostic settings is accomplished via Azure Policy with a DeployIfNotExists effect.

Step-by-Step Solution

1
Address data sovereignty and residency constraints.
Identify that logs from North Europe cannot be sent to a West US workspace. Separate regional workspaces are required.
Data residency rules restrict PII log migration across international borders.
2
Select cost-effective long-term log retention.
Route diagnostic logs to Azure Storage accounts and implement lifecycle policies to archive data up to seven years.
Retaining active logs in a Log Analytics workspace for seven years is extremely expensive compared to archival storage tiers.
3
Identify the mechanism for automated configuration.
Apply Azure Policy using the DeployIfNotExists effect to deploy diagnostic settings automatically upon resource creation.
This automatically remediates compliance gaps without blocking deployment or requiring manual intervention.

Key Concept

Designing compliant, automated, and cost-effective log routing architectures across multiple regions using Azure Policy and Log Analytics.
Rate this question

Topics

Monitoring and Log Routing Solutions