Examkin

Question

Difficulty: HardMonitoring and Log Routing Solutions

An organization has a web application deployed across two Azure regions: East US and North Europe.

The organization must comply with the following monitoring and compliance requirements:
- Data residency: Log data generated by resources in North Europe must reside within the European Union (EU). Log data generated in East US must reside within the United States.
- Access control: Security administrators in North Europe must only be able to view logs from North Europe. Security administrators in East US must only be able to view logs from East US.
- Policy enforcement: All new resources deployed in these regions must automatically have diagnostic settings configured to route logs to the appropriate destination without manual intervention.

You need to design a monitoring and governance solution that meets these requirements while minimizing administrative complexity.

Which solution should you recommend?

  1. Deploy one Log Analytics workspace in East US and another in North Europe. Configure diagnostic settings on regional resources to route to their local workspace. Assign access permissions to regional security administrator Microsoft Entra ID groups at the workspace scope. Deploy Azure Policy definitions using the DeployIfNotExists effect to configure diagnostic settings for new resources.Answer
  2. B
    Deploy a single centralized Log Analytics workspace in East US. Configure diagnostic settings on all resources in both regions to route to this workspace. Use resource-context RBAC to restrict European administrators to only view resources in North Europe.
  3. C
    Deploy one Log Analytics workspace in East US and another in North Europe. Configure diagnostic settings on regional resources to route to their local workspace. Assign the Log Analytics Reader role directly to the individual Azure user accounts of each regional security administrator. Deploy Azure Policy definitions using the DeployIfNotExists effect to configure diagnostic settings for new resources.
  4. D
    Deploy one Log Analytics workspace in East US and another in North Europe. Configure diagnostic settings on regional resources to route to their local workspace. Assign access permissions to regional security administrator Microsoft Entra ID groups at the workspace scope. Deploy Azure Policy definitions using the Deny effect to configure diagnostic settings for new resources.

Answer

Deploy one Log Analytics workspace in East US and another in North Europe. Configure diagnostic settings on regional resources to route to their local workspace. Assign access permissions to regional security administrator Microsoft Entra ID groups at the workspace scope. Deploy Azure Policy definitions using the DeployIfNotExists effect to configure diagnostic settings for new resources.
The correct solution meets the data residency requirement by keeping European log data in the North Europe workspace and US log data in the East US workspace. It implements administrative isolation by assigning permissions at the workspace scope to distinct Microsoft Entra ID groups representing each region's administrators. Finally, it uses Azure Policy with a DeployIfNotExists effect, which is the correct effect to automatically create and configure diagnostic settings on newly deployed resources.

Step-by-Step Solution

1
Evaluate data residency and administrative isolation constraints.
Determine that a multi-workspace design (one in East US and one in North Europe) is required.
Log data must remain within regional boundaries to comply with sovereignty rules, and administrative isolation prevents cross-region access.
2
Determine the proper access delegation model.
Create Microsoft Entra ID security groups for regional administrators and assign them the Log Analytics Reader role at the workspace level.
Assigning RBAC roles to groups rather than individual user accounts aligns with identity governance and security principles.
3
Determine the Azure Policy effect for automatic diagnostic log routing configuration.
Use the DeployIfNotExists policy effect.
DeployIfNotExists allows Azure Policy to deploy diagnostic settings automatically when resources are created, whereas Deny blocks resource creation instead of remediating the configuration.

Key Concept

Designing regional Log Analytics workspace architectures to satisfy data residency and administrative isolation constraints, while automating compliance with group-based RBAC and DeployIfNotExists policy effects.
Rate this question

Topics

Monitoring and Log Routing Solutions