Examkin

Question

Difficulty: Very hardMonitoring and Log Routing Solutions

An enterprise is designing a monitoring and log routing architecture for a healthcare application deployed across two Azure regions: UK South and Switzerland North. The application generates regional database diagnostic logs containing patient health information, and virtual machine performance metrics. The architecture must meet the following requirements:
- All database diagnostic logs must remain strictly within their region of origin due to regional data residency compliance regulations.
- Virtual machine performance metrics must be aggregated centrally in a single workspace in North Europe to facilitate global performance dashboards.
- Diagnostic settings must be automatically applied to any new database or virtual machine resource deployed in these regions.

Which two configurations should you include in the monitoring design? (Select TWO.)

  1. Configure diagnostic settings on regional database resources to route logs to separate Log Analytics workspaces in UK South and Switzerland North respectively, and configure virtual machine diagnostic settings to route metrics to a centralized Log Analytics workspace in North Europe.Answer
  2. Create Azure Policy definitions using the DeployIfNotExists effect to automatically deploy the required diagnostic settings when new resources are provisioned.Answer
  3. C
    Route both database diagnostic logs and virtual machine performance metrics from all regions to a single, centralized Log Analytics workspace in North Europe to minimize workspace overhead.
  4. D
    Directly assign the Log Analytics Reader role to individual database administrator accounts on the respective workspaces to control log access.
  5. E
    Deploy Azure Policy definitions using the Deny effect to block the creation of any database or virtual machine resource that does not have diagnostic settings pre-configured in the deployment template.

Answer

Route database diagnostic logs to separate regional Log Analytics workspaces in UK South and Switzerland North, and route virtual machine performance metrics to a centralized Log Analytics workspace in North Europe; and create Azure Policy definitions using the DeployIfNotExists effect to configure diagnostic settings automatically.
To satisfy compliance requirements, sensitive database diagnostic logs must remain within their regions of origin (UK South and Switzerland North), necessitating separate regional workspaces. However, non-sensitive performance metrics can be consolidated centrally in North Europe to minimize overhead. Automated compliance is best achieved via Azure Policy using the DeployIfNotExists effect, which evaluates and deploys the necessary diagnostic settings directly upon resource creation, preventing manual misconfigurations without interrupting deployment flows.

Step-by-Step Solution

1
Analyze compliance and data residency requirements for database diagnostic logs.
Database diagnostic logs must remain strictly within the regions of origin (UK South and Switzerland North) due to regional regulations.
Ensures that sensitive patient health data does not cross international borders or sovereign regions.
2
Analyze aggregation requirements for performance metrics.
Virtual machine performance metrics can be aggregated in a centralized workspace located in North Europe.
Allows global operations teams to access consolidated metrics and dashboards from a single pane of glass while minimizing workspace sprawl.
3
Select the policy enforcement method for automatic configuration of diagnostic settings.
Deploy Azure Policy definitions with the DeployIfNotExists effect rather than the Deny effect.
DeployIfNotExists automatically applies the required diagnostic settings upon resource creation to ensure compliance, whereas a Deny policy would block the deployment of non-compliant resources without fixing them.

Key Concept

Designing a compliant, hybrid-residency monitoring architecture that segregates sensitive diagnostic data regionally while consolidating non-sensitive operational telemetry globally, enforced automatically via Azure Policy DeployIfNotExists remediation.
Rate this question

Topics

Monitoring and Log Routing Solutions