Examkin

Soru

Zorluk: OrtaMonitoring and Log Routing Solutions

An organization has multiple application teams deploying resources to separate resource groups within a single Azure subscription. You are designing a monitoring and log routing solution. The solution must meet the following requirements:
- Minimize administrative overhead by using the fewest Log Analytics workspaces possible.
- Allow developers to query diagnostic logs only for the specific resources they own.
- Prevent developers from viewing logs of resources owned by other teams.

Which of the following designs should you recommend?

  1. A
    Deploy a separate Log Analytics workspace for each resource group, configure diagnostic settings to route logs to the local workspace, and assign the Log Analytics Reader role to each team on their respective workspace.
  2. B
    Deploy a single centralized Log Analytics workspace, route all diagnostic logs to it, and assign the Log Analytics Reader role on the workspace to all developers while using Azure Policy to restrict queries.
  3. Deploy a single centralized Log Analytics workspace, route all diagnostic logs to this workspace, and grant developers Reader access to their respective Azure resources.Cevap
  4. D
    Deploy a single centralized Log Analytics workspace, route all diagnostic logs to this workspace, and assign the Log Analytics Reader role directly to individual developer user accounts.

Cevap

Deploy a single centralized Log Analytics workspace, route all diagnostic logs to this workspace, and grant developers Reader access to their respective Azure resources.
The correct option minimizes administrative overhead by utilizing a single centralized Log Analytics workspace. To restrict developer access so they only view logs from their own resources, the resource-context access model is used. By granting developers Reader access to their specific resources or resource groups, they can query logs for those resources without having read access to the Log Analytics workspace itself. This prevents them from querying logs from other teams' resources.

Adım Adım Çözüm

1
Analyze the organizational requirement for minimizing administrative overhead.
A single centralized Log Analytics workspace is preferred over multiple regional or per-team workspaces, reducing management complexity.
Creating multiple workspaces increases overhead for lifecycle management, access controls, and cross-workspace querying.
2
Analyze how to enforce security boundaries where developers can only read logs of their own resources.
Use resource-context access control, where permissions are evaluated based on the user's access to the Azure resource itself, not the workspace.
When querying logs via Azure Monitor, if a user has read access to the resource (e.g., Reader role), they can query its diagnostic logs in a centralized workspace without workspace-level permissions.
3
Combine the centralized workspace design with resource-context RBAC permissions.
Route all logs to the central workspace and grant developers Reader permissions on their specific resource groups or resources.
This satisfies all requirements: overhead is minimized, developers can read their own logs, and they cannot access other teams' logs.

Anahtar Kavram

Azure Monitor Log Analytics resource-context access control
Bu soruyu puanla

Konular

Monitoring and Log Routing Solutions