Examkin

Soru

Zorluk: OrtaMonitoring and Log Routing Solutions

An organization has multiple application workloads deployed across separate resource groups in a single Azure region. Each workload is managed by a different support team. You are designing a monitoring and log routing architecture that must satisfy the following requirements:

* All resource diagnostic logs must be collected and stored for centralized compliance analysis.
* If a new or existing resource is deployed without diagnostic settings, they must be automatically configured to route logs to the destination.
* Support teams must only be allowed to view the diagnostic logs of the resources within their respective resource groups.
* The administrative overhead for managing log access and workspace configurations must be minimized.

Which design solution should you recommend?

  1. A
    Deploy a separate Log Analytics workspace for each resource group. Apply an Azure Policy with the DeployIfNotExists effect to configure diagnostic settings. Assign the Log Analytics Reader role to Microsoft Entra security groups at the workspace level.
  2. Deploy a single centralized Log Analytics workspace. Apply an Azure Policy with the DeployIfNotExists effect to configure diagnostic settings. Assign the Monitoring Reader role to Microsoft Entra security groups at the resource group level to enable resource-context log access.Cevap
  3. C
    Deploy a single centralized Log Analytics workspace. Apply an Azure Policy with the DeployIfNotExists effect to configure diagnostic settings. Assign the Monitoring Reader role directly to individual user accounts of each support team member at the resource group level.
  4. D
    Deploy a single centralized Log Analytics workspace. Apply an Azure Policy with the Deny effect to block resource deployments lacking diagnostic settings. Assign the Monitoring Reader role to Microsoft Entra security groups at the resource group level.

Cevap

Deploy a single centralized Log Analytics workspace. Apply an Azure Policy with the DeployIfNotExists effect to configure diagnostic settings. Assign the Monitoring Reader role to Microsoft Entra security groups at the resource group level to enable resource-context log access.
A single centralized Log Analytics workspace minimizes workspace management overhead. Using Azure Policy with the DeployIfNotExists effect automatically creates diagnostic settings to route resource logs to the workspace. By assigning the Monitoring Reader role to Microsoft Entra security groups at the resource group level, support teams can view logs for their resources from the centralized workspace using resource-context access, without needing permissions on the workspace itself.

Adım Adım Çözüm

1
Select a single Log Analytics workspace for the region.
Minimizes administrative overhead and avoids managing multiple workspaces.
Designing multiple regional workspaces for isolation is unnecessary when resource-context RBAC can restrict log access.
2
Configure Azure Policy with the DeployIfNotExists effect for resource diagnostics.
Automatically deploys diagnostic settings pointing to the centralized workspace for new and existing resources.
DeployIfNotExists remediates resources automatically, whereas a Deny effect would block deployments and disrupt CI/CD pipelines.
3
Assign the Monitoring Reader role to Microsoft Entra security groups at the resource group scope.
Enables resource-context logging, letting users view logs for only the resources they have access to, without workspace-level permissions.
Assigning RBAC to groups rather than individual users ensures scalable governance and security.

Anahtar Kavram

Centralized log routing with resource-context access control and automated compliance remediation via DeployIfNotExists policy.
Bu soruyu puanla

Konular

Monitoring and Log Routing Solutions