Soru

Zorluk: OrtaLog Analytics Workspaces and KQL Queries

An administrator is configuring access control for an Azure Log Analytics workspace named Workspace1. Workspace1 collects diagnostic logs and performance metrics from 50 Azure virtual machines distributed across multiple resource groups. A group of developers must be able to query the performance logs of only the virtual machines they manage. The developers must not be able to view logs for other virtual machines, and they must not have access to Workspace1. Which two settings or assignments should the administrator configure? Select two.

  1. Configure the access control mode of Workspace1 to use resource or workspace permissions.Cevap
  2. Assign the Reader role to the developers on the specific virtual machines they manage.Cevap
  3. C
    Configure the access control mode of Workspace1 to require workspace permissions.
  4. D
    Assign the Log Analytics Reader role to the developers on Workspace1.
  5. E
    Configure a diagnostic setting on the virtual machines to send logs to an Azure Storage account.

Cevap

Configure the access control mode of Workspace1 to use resource or workspace permissions and assign the Reader role to the developers on the specific virtual machines they manage.
To restrict access so that users can query logs only for the specific virtual machines they manage without workspace access, you must implement resource-context access. This requires configuring the access control mode of Workspace1 to use resource or workspace permissions. Additionally, the developers must have read permissions (such as the Reader role) on the specific virtual machines they manage.

Adım Adım Çözüm

1
Determine the required access mode to restrict access to logs by resource.
Identify that resource-context permissions must be used, which is achieved by setting the workspace access control mode to 'Use resource or workspace permissions'.
This allows users to access logs for resources they have permissions for, without needing workspace permissions.
2
Determine the required resource-level role for the developers.
Assign the Reader role to developers on the specific virtual machines they manage.
Users need read permissions on the resource to perform resource-context queries.

Anahtar Kavram

Log Analytics Access Control Modes (Workspace-context vs. Resource-context)
Bu soruyu puanla