Examkin

Soru

Zorluk: ZorMonitoring and Log Routing Solutions

A financial services company is designing a monitoring and log routing architecture for its Azure environment, which spans the East US and North Europe regions. The architecture must meet the following requirements:
- Diagnostic logs from resources in both regions must be collected.
- To comply with local data residency regulations, logs generated in East US must remain within the United States, and logs generated in North Europe must remain within the European Union.
- A centralized security operations team requires real-time access to security-related logs from both regions using a third-party SIEM tool.
- Internal audit teams must have read-only access to log data originating from their respective regions only, without the ability to view logs from other regions.
- Management overhead and the number of Log Analytics workspaces must be minimized.

Which log routing and workspace configuration should you recommend?

  1. A
    Deploy one Log Analytics workspace in East US and one in North Europe. Configure diagnostic settings to route resource logs to their respective regional workspaces. Assign the Log Analytics Reader role directly to individual auditor user accounts on their respective regional workspaces. Configure diagnostic settings to stream security logs to regional Azure Event Hubs for SIEM ingestion.
  2. Deploy one Log Analytics workspace in East US and one in North Europe. Configure diagnostic settings to route resource logs to their respective regional workspaces. Assign regional audit teams to Microsoft Entra ID groups, and assign the Reader role to these groups at the workspace level. Configure resource diagnostic settings to stream security logs to regional Azure Event Hubs for SIEM ingestion.Cevap
  3. C
    Deploy a single centralized Log Analytics workspace in East US. Configure diagnostic settings for resources in both East US and North Europe to route logs to this central workspace. Assign Microsoft Entra ID groups for each audit team and grant them workspace-context RBAC access filtered by resource group.
  4. D
    Deploy a single centralized Log Analytics workspace in North Europe. Create an Azure Policy with a 'Deny' effect to prevent logs from East US from being written to the workspace. Configure resource diagnostic settings to route all resource logs to this workspace, relying on the policy to enforce data residency.

Cevap

Deploy one Log Analytics workspace in East US and one in North Europe, routing regional logs to their respective workspaces, managing audit permissions via Microsoft Entra groups assigned at the workspace level, and streaming security logs to regional Azure Event Hubs for real-time SIEM ingestion.
Deploying regional Log Analytics workspaces ensures compliance with data residency regulations by keeping logs within their respective geographic boundaries. Group-based RBAC assignments follow standard identity governance principles to control audit access. Streaming logs to Azure Event Hubs enables real-time ingestion by third-party SIEM tools without introducing unnecessary workspace or routing overhead.

Adım Adım Çözüm

1
Analyze regional residency and isolation constraints for resource logs.
Logs from East US must remain in the United States, and logs from North Europe must remain within the European Union.
Log Analytics workspaces store data within the region where they are provisioned. Therefore, separate workspaces in East US and North Europe are required to satisfy the data residency compliance rules.
2
Evaluate access requirements and design the authorization model for the audit teams.
Create regional Microsoft Entra ID groups and assign them workspace-level Reader permissions.
Assigning RBAC roles directly to individual user accounts introduces governance risks and high management overhead, making group-based assignment the correct approach.
3
Determine the routing mechanism for the real-time SIEM integration.
Configure resource diagnostic settings to stream security logs to regional Azure Event Hubs.
Event Hubs provide a low-latency, real-time message streaming pipeline suitable for ingestion by third-party SIEM tools without requiring log centralization in a single Log Analytics workspace.

Anahtar Kavram

Log routing and workspace design must balance data sovereignty requirements (requiring regional workspaces) with administrative overhead, while utilizing group-based access control and Event Hubs for real-time SIEM ingestion.
Bu soruyu puanla

Konular

Monitoring and Log Routing Solutions