Examkin

Question

Difficulty: MediumMonitoring and Log Routing Solutions

A manufacturing enterprise is designing a monitoring and log routing architecture for its workloads deployed across the West US 3 and West Europe regions. The design must satisfy the following constraints:
- All application logs generated in the West Europe region must reside in Europe to comply with local data sovereignty regulations.
- Operations team members who only manage West US 3 resources must only be allowed to view logs originating from those West US 3 resources.
- High-priority security alerts must be streamed in near real-time to a third-party Security Information and Event Management (SIEM) system.
- The deployment and maintenance of diagnostic settings should be automated.

Which two of the following components should you include in the design? (Select two.)

  1. A Log Analytics workspace in West Europe and a Log Analytics workspace in West US 3Answer
  2. An Azure Event Hubs namespace to stream log data to the third-party SIEMAnswer
  3. C
    A single, centrally managed Log Analytics workspace in West US 3 to minimize workspace proliferation
  4. D
    An Azure Policy definition configured with the Deny effect to enforce the deployment of diagnostic settings
  5. E
    Direct RBAC role assignments to individual operations team member accounts at the resource group level

Answer

A Log Analytics workspace in West Europe and a Log Analytics workspace in West US 3, along with an Azure Event Hubs namespace to stream log data to the third-party SIEM.
The correct architecture requires a multi-workspace approach (a Log Analytics workspace in West Europe and another in West US 3) to comply with data sovereignty guidelines that mandate European logs remain in Europe. Additionally, an Azure Event Hubs namespace is required to handle near real-time streaming of security alerts to an external SIEM system.

Step-by-Step Solution

1
Address data sovereignty requirements.
Identify that a dedicated Log Analytics workspace must be provisioned in West Europe to keep European log data within Europe, and a separate workspace in West US 3.
Data residency regulations prevent sending West Europe log data to a US-based workspace.
2
Determine the streaming mechanism for the third-party SIEM.
Include Azure Event Hubs in the architecture to act as an ingestion point for near real-time log streaming.
Event Hubs is the standard Azure component for streaming logs to external SIEM systems in near real-time.
3
Evaluate access and governance configuration.
Ensure security groups are used for RBAC assignment, and rely on DeployIfNotExists policies to automate diagnostic configurations.
This aligns with governance best practices and minimizes administrative overhead.

Key Concept

Designing compliant, regional log routing using separate Log Analytics workspaces for data residency and utilizing Event Hubs for real-time external log integration.
Estimated Time:2m 0s
Rate this question

Topics

Monitoring and Log Routing Solutions