Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

An enterprise is designing a monitoring and log routing architecture for application workloads deployed across two Azure regions: East US and West US.

The design must meet the following requirements:
- Members of the East US operations team must only view logs for East US resources.
- Members of the West US operations team must only view logs for West US resources.
- A central security team must be able to query logs across both regions.
- Cross-region data egress costs for log ingestion must be minimized.
- All newly deployed resources in both regions must be automatically configured to route their diagnostic logs to the appropriate destination.
- Administrative governance and access management must follow Microsoft best practices.

Which log routing and access management strategy should you recommend?

  1. Deploy a Log Analytics workspace in East US and another in West US. Associate the regional operations teams with Microsoft Entra groups and assign each group the Reader role on its respective regional workspace. Assign the central security team's Entra group the Reader role on both workspaces. Use Azure Policy with a DeployIfNotExists effect to automatically configure diagnostic settings for new resources to point to their local regional workspace.Answer
  2. B
    Deploy a single centralized Log Analytics workspace in East US. Associate the regional operations teams with Microsoft Entra groups and configure resource-context RBAC to limit their access to their respective resources. Use Azure Policy with a DeployIfNotExists effect to automatically configure diagnostic settings for new resources in both regions to route logs to the centralized workspace.
  3. C
    Deploy a Log Analytics workspace in East US and another in West US. Assign the workspace-level Reader role directly to the individual Azure user accounts of each member of the regional operations teams. Use Azure Policy with a DeployIfNotExists effect to automatically configure diagnostic settings for new resources to point to their local regional workspace.
  4. D
    Deploy a Log Analytics workspace in East US and another in West US. Associate the regional operations teams with Microsoft Entra groups and assign each group the Reader role on its respective regional workspace. Assign the central security team's Entra group the Reader role on both workspaces. Use Azure Policy with a Deny effect to block the deployment of any resources that do not have diagnostic settings manually configured to route to the correct regional workspace.

Answer

Deploy a Log Analytics workspace in each region, use Microsoft Entra groups to assign workspace-level Reader roles to the respective regional teams and the security team, and apply Azure Policy with a DeployIfNotExists effect to automate diagnostic settings configuration.
The correct strategy involves deploying separate regional workspaces to keep data transfer local, thereby minimizing cross-region egress costs. Administrative isolation is achieved by assigning regional teams workspace-level Reader permissions via Microsoft Entra groups, which aligns with identity governance best practices. The central security team can query logs across both workspaces. Lastly, the DeployIfNotExists policy effect is the correct choice to automate the configuration of diagnostic settings on newly deployed resources.

Step-by-Step Solution

1
Determine the workspace architecture and placement based on cost constraints.
Two regional Log Analytics workspaces (one in East US, one in West US) are required to ensure that logs are ingested within the same region, avoiding cross-region egress charges.
Log ingestion across regions incurs data transfer costs, which violates the requirement to minimize data egress costs.
2
Define the access control and administrative mapping using Microsoft Entra groups.
Regional teams are assigned Reader access to their respective workspaces using Entra groups to enforce regional isolation, while the central security group is assigned Reader access to both workspaces.
Microsoft best practices dictate assigning roles to groups rather than individuals to reduce administrative overhead and ensure scalable identity governance.
3
Select the policy effect that satisfies automatic compliance remediation.
An Azure Policy with the DeployIfNotExists effect is deployed to automatically configure diagnostic settings on newly created resources.
A DeployIfNotExists policy automatically remediates non-compliant resources by creating the diagnostic settings, whereas a Deny policy would reject the deployment outright.

Key Concept

Designing regional monitoring solutions that balance regional log isolation, data egress costs, Entra ID identity governance, and automated configuration using Azure Policy.
Rate this question

Topics

Monitoring and Log Routing Solutions