Microsoft Certified: Azure Security Engineer AssociateManage security operationsMedium
A global organization uses Azure Monitor and Log Analytics across multiple Azure regions. They want to centralize security event collection from all resources into a single Log Analytics workspace for easier monitoring and threat hunting. What is the most significant challenge they will face with this centralized approach, especially for resources in distant regions?
- AIncreased cost due to higher data ingestion rates in a single workspace.
- BHigher latency for data ingestion from geographically distant resources.
- CInability to use custom fields for different data types in a single workspace.
- DDifficulty in applying role-based access control (RBAC) to the centralized workspace.
Show answer & explanationAnswer & explanation
Correct answer: B. Higher latency for data ingestion from geographically distant resources.
The most significant challenge with centralizing logs from geographically distant resources into a single Log Analytics workspace is increased data ingestion latency. Data has to travel across regions, which can delay its availability for real-time monitoring and incident response.
Why the other options are wrong
- A. While data ingestion costs might increase due to volume, they are typically calculated per GB, regardless of workspace count. The primary problem here is latency, not just cost.
- C. Custom fields can be used for any data type within a Log Analytics workspace, providing flexibility regardless of data source.
- D. Log Analytics workspaces support granular RBAC, allowing different teams access to specific tables or data sets, so this is not a significant challenge.
Log Analytics Centralization Challenges
Potential difficulties encountered when consolidating log data from diverse, geographically dispersed Azure resources into a single Log Analytics workspace.
- Primary concern is data ingestion latency from distant regions.
- Can impact real-time monitoring and incident response.
- Cost considerations also exist but latency is often more critical for security.
Memory trick: Distance Delays Data Delivery.