Examkin

Question

Difficulty: Very hardMonitoring and Log Routing Solutions

An organization has Azure subscriptions in the East US and West Europe regions. The organization must design a monitoring and log routing architecture that meets the following requirements:

1. All resource diagnostic logs and Azure Activity logs must be retained for auditing.
2. Under no circumstances may log data generated by resources in the West Europe region be transferred to or stored in the United States, to comply with strict data sovereignty regulations.
3. The security team requires real-time streaming of all security-related log data from both regions to an external, third-party Security Information and Event Management (SIEM) system.
4. Future resources must automatically have diagnostic settings configured upon deployment to route logs to the appropriate destinations without administrative intervention.
5. Administrative overhead and costs must be minimized.

Which design should you recommend?

  1. Deploy a Log Analytics workspace and an Azure Event Hub in East US, and another Log Analytics workspace and Azure Event Hub in West Europe. Assign an Azure Policy definition with the DeployIfNotExists effect to automatically configure diagnostic settings routing to the local workspace and Event Hub. Configure the SIEM to retrieve logs from both regional Event Hubs.Answer
  2. B
    Deploy a single centralized Log Analytics workspace and a single Azure Event Hub in East US. Assign an Azure Policy definition with the DeployIfNotExists effect to automatically configure diagnostic settings routing all logs to this workspace and Event Hub. Configure the SIEM to retrieve logs from the East US Event Hub.
  3. C
    Deploy a Log Analytics workspace and an Azure Storage account in East US, and another Log Analytics workspace and Azure Storage account in West Europe. Assign an Azure Policy definition with the Deny effect to block resource deployments lacking diagnostic settings. Configure a scheduled tool to pull logs from the storage accounts to the SIEM.
  4. D
    Deploy a Log Analytics workspace and an Azure Event Hub in East US, and another Log Analytics workspace and Azure Event Hub in West Europe. Assign an Azure Policy definition with the DeployIfNotExists effect. Assign the Monitoring Contributor role directly to individual administrator user accounts at the subscription level to allow diagnostic configuration. Stream all West Europe logs to the East US Event Hub.

Answer

Deploy regional Log Analytics workspaces and Event Hubs, and use Azure Policy with the DeployIfNotExists effect to automatically configure diagnostic settings routing logs locally.
The correct architecture uses regional Log Analytics workspaces and Event Hubs in both East US and West Europe. This complies with data residency rules by keeping European log data within Europe. Using Azure Policy with a DeployIfNotExists effect automatically provisions diagnostic settings upon resource deployment, ensuring compliance without blocking user actions. Regional Event Hubs facilitate real-time, low-latency streaming to the external SIEM.

Step-by-Step Solution

1
Analyze data residency constraints.
Separate Log Analytics workspaces and Event Hubs must be deployed in West Europe and East US to ensure West Europe data does not leave its region.
Data sovereignty regulations prohibit West Europe logs from being stored or transferred to the US.
2
Determine real-time streaming method to external SIEM.
Use Azure Event Hubs in each region as the routing target for diagnostic logs.
Event Hubs provide low-latency, real-time message streaming suitable for SIEM integration.
3
Evaluate policy mechanism for automatic enforcement.
Use Azure Policy with the DeployIfNotExists effect.
DeployIfNotExists automatically creates the diagnostic settings when resources are deployed, whereas Deny would only block deployment without setting them up.

Key Concept

Log routing architecture with geographic residency, real-time SIEM streaming, and policy-driven automation.
Rate this question

Topics

Monitoring and Log Routing Solutions