Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

An enterprise operates a web application deployed in both the East US and North Europe regions. European Union (EU) data sovereignty regulations mandate that all monitoring logs containing EU user activity must remain physically within Europe and be accessible only by European administrators. US operations logs have no such restrictions. You need to design an Azure Monitor log routing solution that complies with these regulations while adhering to Microsoft security and administrative best practices. Which design should you recommend?

  1. Deploy a Log Analytics workspace in North Europe and a separate Log Analytics workspace in East US. Configure diagnostic settings on regional resources to route logs to their respective regional workspaces, and grant workspace access to EU administrators via Microsoft Entra groups.Answer
  2. B
    Deploy a single centralized Log Analytics workspace in East US. Configure diagnostic settings on all resources in both regions to route to this centralized workspace, using workspace-level access control list (ACL) rules to segregate regional log views.
  3. C
    Deploy separate Log Analytics workspaces in North Europe and East US. Route logs to their respective regional workspaces, and directly assign the Log Analytics Reader role to the individual user accounts of each EU administrator.
  4. D
    Deploy separate Log Analytics workspaces in North Europe and East US. Enforce diagnostic settings compliance by using an Azure Policy with the Deny effect to automatically create and configure diagnostic settings on new resources.

Answer

Deploy a Log Analytics workspace in North Europe and a separate Log Analytics workspace in East US. Configure diagnostic settings on regional resources to route logs to their respective regional workspaces, and grant workspace access to EU administrators via Microsoft Entra groups.
The correct design utilizes regional Log Analytics workspaces to satisfy regional data residency requirements for EU data sovereignty. Access is granted through Microsoft Entra groups rather than individual user accounts to adhere to RBAC scalability and security best practices.

Step-by-Step Solution

1
Analyze compliance and data sovereignty requirements.
EU logs must reside in Europe, which requires deploying a separate Log Analytics workspace in the North Europe region.
Data sovereignty mandates local data residency; centralized workspaces across regional boundaries are not compliant in this scenario.
2
Evaluate identity and access management requirements.
EU administrators should access the EU workspace using Microsoft Entra security groups.
Directly assigning roles to user accounts increases administrative overhead and violates standard identity governance practices.
3
Determine the correct Azure Policy configuration for compliance enforcement.
Use DeployIfNotExists or Modify policies instead of Deny policies if automatic remediation of diagnostic settings is needed.
Deny policy effects block non-compliant deployments rather than automatically configuring log routing settings.

Key Concept

Designing regional and compliant log routing architectures using Azure Monitor, Log Analytics workspaces, and Microsoft Entra RBAC best practices.
Rate this question

Topics

Monitoring and Log Routing Solutions