Question

Difficulty: EasyMonitoring and Log Routing Solutions

An organization needs to collect Azure diagnostic logs for resources deployed across two distinct regulatory jurisdictions (Europe and the US). The requirements are:

1. Europe diagnostic logs must remain resident in Europe.
2. US diagnostic logs must remain resident in the US.
3. Access to the logs must be granted to the security team using the most scalable and maintainable administrative model.

Which two configurations should you include in the monitoring and governance design?

  1. Deploy separate Log Analytics workspaces in the Europe and US regions.Answer
  2. Assign the Monitoring Reader role to a Microsoft Entra group containing the security team members.Answer
  3. C
    Deploy a single centralized Log Analytics workspace in the East US region to store all logs.
  4. D
    Assign the Monitoring Reader role directly to the individual user accounts of each security team member.
  5. E
    Configure an Azure Policy with a Deny effect to automatically deploy diagnostic settings for all new resources.

Answer

To satisfy the regional data residency requirements, you must deploy separate Log Analytics workspaces in Europe and the US. To manage security permissions scaleably, you should assign the Monitoring Reader role to a Microsoft Entra ID group rather than individual users.
Deploying separate Log Analytics workspaces in the Europe and US regions ensures that diagnostic logs do not leave their respective geographical boundaries, fulfilling the regional residency requirement. Assigning the Monitoring Reader role to a Microsoft Entra group simplifies administrative management by allowing permissions to be updated through group membership rather than individual role assignments.

Step-by-Step Solution

1
Analyze data residency requirements.
Europe logs must stay in Europe; US logs must stay in the US.
This prevents cross-region data transfer, requiring regional workspaces.
2
Evaluate the governance and access model.
Assign permissions to a security group rather than individuals.
Group-based assignment reduces administrative overhead and ensures scalability.
3
Evaluate automatic diagnostic deployment strategy.
DeployIfNotExists is the correct policy effect for remediation, not Deny.
A Deny policy would block deployment rather than automatically configuring diagnostics.

Key Concept

Designing regional log routing architecture and scalable access control for Azure Monitor Log Analytics.
Estimated Time:1m 30s
Rate this question