Examkin

Soru

Zorluk: OrtaLog Analytics Workspaces and KQL Queries

You have an Azure subscription containing a Log Analytics workspace named Workspace1 and a virtual machine named VM1. VM1 sends its diagnostic logs to Workspace1. You need to allow a developer to query the logs of VM1. The developer must not be able to view logs for any other resources in Workspace1. Which action should you perform?

  1. Assign the Reader role on VM1 to the developer.Cevap
  2. B
    Assign the Log Analytics Reader role on Workspace1 to the developer and apply a ReadOnly resource lock to Workspace1.
  3. C
    Assign the Log Analytics Reader role on the resource group containing Workspace1 to the developer, and create an Azure RBAC deny assignment for other resources.
  4. D
    Assign the Log Analytics Reader role on Workspace1 to the developer and configure the workspace Access Control Mode to Require workspace permissions.

Cevap

Assign the Reader role on VM1 to the developer.
Assigning the Reader role on VM1 grants the developer resource-context log access. When the workspace is set to its default access mode, permissions on the resources themselves govern log access. This allows the developer to query VM1's logs from the VM blade or directly via resource-context query interfaces without granting visibility into other resources' logs in the workspace.

Adım Adım Çözüm

1
Determine the required level of access control for the developer's request.
The developer needs access to VM1 logs only, without visibility into other logs in Workspace1.
This requires resource-context log access where log visibility is governed by permissions on the resources themselves.
2
Evaluate the default Log Analytics workspace access mode setting.
The default setting is 'Use resource or workspace permissions' (resource-context).
This setting allows users with read access to a specific resource to query logs for that resource.
3
Assign the appropriate RBAC role to target resource VM1.
Assigning the Reader role on VM1 grants the developer resource-context permissions.
This ensures the developer can access VM1's logs via resource-context without having workspace-level permissions that would expose other resources.

Anahtar Kavram

Log Analytics Workspace Access Control (Resource-context vs Workspace-context)
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Log Analytics Workspaces and KQL Queries

Bu konudan daha fazla soru