Examkin

Question

Difficulty: HardMonitoring and Log Routing Solutions

An organization is designing a monitoring and log routing architecture for application workloads deployed across two Azure regions: East US and North Europe. The solution must meet the following requirements:
- Regulatory compliance mandates that operational logs generated in North Europe must reside within the North Europe region and must not be accessible from the East US region.
- Resource owners must only be able to query logs for the specific Azure resources they own, without having access to other operational logs in the same workspace.
- Diagnostic settings for all newly created virtual machines must be configured automatically to route logs to the appropriate regional workspace.

Which two configurations should you include in the design to meet the requirements?

  1. Separate Log Analytics workspaces in East US and North Europe with the workspace access mode configured to require resource-context access.Answer
  2. B
    A single centralized Log Analytics workspace located in East US with workspace-context RBAC permissions assigned to resource owners.
  3. An Azure Policy definition configured with the DeployIfNotExists effect to deploy diagnostic settings to new virtual machines.Answer
  4. D
    An Azure Policy definition configured with the Deny effect to block virtual machine deployments that lack pre-configured diagnostic settings.
  5. E
    Diagnostic settings that stream logs to a regional Event Hubs namespace, with Monitoring Reader roles assigned directly to individual resource owner user accounts.

Answer

Include separate Log Analytics workspaces in East US and North Europe with resource-context access configured, along with an Azure Policy definition that uses the DeployIfNotExists effect to apply diagnostic settings to new virtual machines.
The solution requires regional data residency and resource-context access. Creating separate regional workspaces (one in East US and one in North Europe) with resource-context enabled ensures compliance with data residency and allows resource-based access. Azure Policy with a DeployIfNotExists effect automatically configures VM diagnostic settings to point to the correct regional workspace upon creation.

Step-by-Step Solution

1
Address data residency and compliance requirements.
Determine that separate Log Analytics workspaces are required in East US and North Europe to ensure European logs remain in North Europe.
Regulatory compliance requires that logs do not leave their respective regions.
2
Select the appropriate workspace access mode to enforce granular access controls.
Configure resource-context access mode on the workspaces.
This allows resource owners to view logs for only their resources, rather than giving them workspace-wide access.
3
Automate the deployment of diagnostic settings.
Implement an Azure Policy definition using the DeployIfNotExists effect targeting virtual machines.
The DeployIfNotExists effect automatically applies diagnostic settings to new resources upon deployment, whereas the Deny effect would block creation instead of performing auto-configuration.

Key Concept

Designing compliant, secure, and automated log routing architectures using regional Log Analytics workspaces, resource-context access control, and Azure Policy remediation.
Rate this question

Topics

Monitoring and Log Routing Solutions