Examkin

Soru

Zorluk: OrtaMonitoring and Log Routing Solutions

A logistics company runs application workloads in Azure across two regions: East US 2 and UK South. The compliance department mandates that all log data generated by resources in UK South must reside in the United Kingdom due to data sovereignty laws. The operations team needs to query these logs to monitor health, but engineers must only be allowed to view logs for the specific Azure resources they have permission to manage. You need to design a monitoring and log routing architecture that meets these requirements while minimizing administrative overhead for access control. Which solution should you recommend?

  1. Deploy a Log Analytics workspace in each region, and configure the workspaces to use resource-context access.Cevap
  2. B
    Deploy a single Log Analytics workspace in East US 2, and configure the workspace to use workspace-context access.
  3. C
    Deploy a Log Analytics workspace in each region, and assign individual engineer user accounts the Reader role on the workspaces.
  4. D
    Deploy a Log Analytics workspace in each region, and use an Azure Policy definition with a Deny effect to block resources that do not have diagnostic settings configured.

Cevap

Deploy a Log Analytics workspace in each region, and configure the workspaces to use resource-context access.
The configuration utilizing a Log Analytics workspace in each region combined with resource-context access meets all requirements. Regional workspaces keep UK South log data within the United Kingdom, adhering to data sovereignty regulations. Resource-context access (which uses the 'use resource permissions' setting) allows users to query logs of resources they manage without requiring workspace-level permissions, minimizing RBAC administrative overhead.

Adım Adım Çözüm

1
Evaluate data residency requirements to determine workspace placement.
Determine that two regional Log Analytics workspaces are required (one in East US 2 and one in UK South).
Log data generated by UK South resources must stay in the United Kingdom to comply with data sovereignty regulations.
2
Select the appropriate access control mode for the workspaces to meet the security and administrative requirements.
Select resource-context access (using resource permissions) for both workspaces.
Resource-context access allows engineers to view logs for resources they are authorized to manage without needing permissions on the workspace itself, minimizing the need to manage workspace-level RBAC.
3
Validate the solution against alternative governance options.
Reject direct user-level RBAC assignments and restrictive Deny policies.
Direct user role assignments scale poorly, and Deny policies block resource provisioning instead of remediating them automatically.

Anahtar Kavram

Designing regional Log Analytics architectures and access modes to satisfy data residency, access isolation, and administrative efficiency.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Monitoring and Log Routing Solutions