Examkin

Soru

Zorluk: ZorMonitoring and Log Routing Solutions

An enterprise is designing a monitoring and log routing architecture for a multi-region workload deployed in East US and West Europe. The architecture must meet the following requirements:
- Logs generated by resources in West Europe must remain resident within the European Union (EU) to comply with data sovereignty regulations.
- Access to logs must be restricted so that application developers can only view diagnostic data for the specific resources they own, without having access to other resources' logs stored in the same workspace.
- Diagnostic logs from Azure Key Vault and Azure SQL Database instances must be streamed in real-time to a third-party SIEM platform in each respective region.
- Administrative overhead for managing log access permissions must be minimized.

Which two components or configurations should you include in the design to meet these requirements? (Choose two.)

  1. Separate Log Analytics workspaces in East US and West Europe configured to use resource-context access control.Cevap
  2. An Azure Event Hubs namespace in each region with diagnostic settings configured on resources to stream logs to their regional event hub.Cevap
  3. C
    A single centralized Log Analytics workspace in East US configured with workspace-context access control.
  4. D
    Log Analytics Reader role assignments granted directly to individual developer user accounts on the workspaces.
  5. E
    Azure Policy definitions with a Deny effect to block resource deployments that do not specify the correct regional Event Hub destination in their diagnostic settings.

Cevap

Configure separate Log Analytics workspaces in East US and West Europe using resource-context access control, and deploy regional Azure Event Hubs namespaces with diagnostic settings configured to stream resource logs to their respective regional event hubs.
The correct options are configuring separate Log Analytics workspaces in each region using resource-context access control, and deploying regional Azure Event Hubs namespaces to stream logs via diagnostic settings. Creating separate workspaces ensures that EU log data remains physically stored in Europe, satisfying sovereignty requirements. Resource-context access ensures that developers can only see logs for resources they are authorized to manage, without workspace-level permissions. Event Hubs namespaces in both regions provide the required real-time streaming capability to the SIEM tool while maintaining regional data compliance.

Adım Adım Çözüm

1
Address data sovereignty and residency constraints.
Determine that logs generated in West Europe must remain resident in the EU, necessitating separate Log Analytics workspaces in East US and West Europe rather than a single centralized workspace.
Regulatory compliance (e.g., GDPR) forbids sending EU diagnostic data to a US-based workspace, requiring regional isolation of storage.
2
Configure granular access control for developers while minimizing administrative overhead.
Select resource-context access control for the Log Analytics workspaces.
Resource-context access automatically allows developers to view logs for only the resources they own (based on their resource-level RBAC permissions), eliminating the overhead of managing permissions at the workspace level.
3
Design the log routing path for real-time SIEM ingestion.
Incorporate regional Azure Event Hubs namespaces and configure diagnostic settings on the resources to route logs to the local Event Hub.
Azure Event Hubs provides the low-latency streaming needed for SIEM ingestion, and keeping them in their respective regions aligns with the data residency constraints.

Anahtar Kavram

Designing regional log routing architectures to satisfy data sovereignty while leveraging resource-context RBAC to minimize monitoring administrative overhead.
Bu soruyu puanla

Konular

Monitoring and Log Routing Solutions