Examkin

Soru

Zorluk: ZorMonitoring and Log Routing Solutions

A pharmaceutical company is designing a log routing and governance strategy for its Azure resources deployed across the East US and West Europe regions. The design must meet the following requirements:

- Diagnostic logs from Azure Key Vault instances must be automatically collected and routed immediately upon resource deployment.
- Key Vault logs must remain within their region of origin to comply with regional data sovereignty regulations.
- A global security team must be able to view logs from both regions, whereas regional IT administrators must only be able to view logs from their respective region.
- Permitted access must be assigned to groups rather than individual users to simplify identity management.

Which design should you recommend?

  1. Create regional Log Analytics workspaces in East US and West Europe. Use an Azure Policy configured with the DeployIfNotExists effect to automatically configure diagnostic settings routing Key Vault logs to their respective regional workspace. Assign the Monitoring Reader role on each workspace to Microsoft Entra security groups containing the respective regional administrators, and assign the role on both workspaces to a group for the global security team.Cevap
  2. B
    Create a single centralized Log Analytics workspace in East US. Use an Azure Policy configured with the DeployIfNotExists effect to automatically configure diagnostic settings routing all Key Vault logs to this workspace. Assign the Monitoring Reader role on the workspace to Microsoft Entra security groups containing the regional and global administrators.
  3. C
    Create regional Log Analytics workspaces in East US and West Europe. Use an Azure Policy configured with the DeployIfNotExists effect to automatically configure diagnostic settings routing Key Vault logs to their respective regional workspace. Assign the Monitoring Reader role on each workspace directly to the individual Azure user accounts of the regional and global administrators.
  4. D
    Create regional Log Analytics workspaces in East US and West Europe. Use an Azure Policy configured with the Deny effect to block Key Vault deployment if diagnostic settings are not configured. Assign the Monitoring Reader role on each workspace to Microsoft Entra security groups containing the respective regional administrators, and assign the role on both workspaces to a group for the global security team.

Cevap

The correct design uses regional Log Analytics workspaces to satisfy regional data residency and sovereignty requirements. Using an Azure Policy with the DeployIfNotExists effect ensures that any newly deployed Key Vault is automatically configured with diagnostic settings without blocking resources. Group-based RBAC assignments conform to governance best practices by avoiding direct user assignments.
The correct design uses regional workspaces to ensure that logs do not leave their geographical boundaries, complying with data residency requirements. It automates log routing using the DeployIfNotExists policy effect, which corrects non-compliance by adding diagnostic settings. It assigns permissions to Microsoft Entra security groups rather than individual users, which aligns with governance best practices.

Adım Adım Çözüm

1
Address data residency constraints.
Establish separate regional Log Analytics workspaces in East US and West Europe so that logs do not cross regional boundaries, satisfying data sovereignty requirements.
Diagnostic logs must remain in their region of origin.
2
Select the policy effect for automated collection.
Configure Azure Policy using the DeployIfNotExists effect.
DeployIfNotExists automatically remediates and creates diagnostic settings upon resource deployment, whereas Deny would disrupt workflows by blocking deployments.
3
Implement identity and access governance.
Create Microsoft Entra security groups for regional administrators and the global security team. Assign the Monitoring Reader role to the regional groups on their corresponding workspaces, and assign it to the global group on both workspaces.
Assigning roles to groups instead of individual accounts ensures administrative scalability and conforms to governance best practices.

Anahtar Kavram

Designing compliant, automated, and secure log routing architectures across multiple regions using Azure Policy, Log Analytics workspaces, and Microsoft Entra ID groups.
Bu soruyu puanla

Konular

Monitoring and Log Routing Solutions