Microsoft Certified: Azure Security Engineer AssociateManage security operationsMedium

A global organization uses Azure Monitor and Log Analytics across multiple Azure regions. They want to centralize security event collection from all resources into a single Log Analytics workspace for easier monitoring and threat hunting. What is the most significant challenge they will face with this centralized approach, especially for resources in distant regions?

  1. AIncreased cost due to higher data ingestion rates in a single workspace.
  2. BHigher latency for data ingestion from geographically distant resources.
  3. CInability to use custom fields for different data types in a single workspace.
  4. DDifficulty in applying role-based access control (RBAC) to the centralized workspace.
Show answer & explanation

Correct answer: B. Higher latency for data ingestion from geographically distant resources.

The most significant challenge with centralizing logs from geographically distant resources into a single Log Analytics workspace is increased data ingestion latency. Data has to travel across regions, which can delay its availability for real-time monitoring and incident response.

Why the other options are wrong

  • A. While data ingestion costs might increase due to volume, they are typically calculated per GB, regardless of workspace count. The primary problem here is latency, not just cost.
  • C. Custom fields can be used for any data type within a Log Analytics workspace, providing flexibility regardless of data source.
  • D. Log Analytics workspaces support granular RBAC, allowing different teams access to specific tables or data sets, so this is not a significant challenge.

Log Analytics Centralization Challenges

Potential difficulties encountered when consolidating log data from diverse, geographically dispersed Azure resources into a single Log Analytics workspace.

  • Primary concern is data ingestion latency from distant regions.
  • Can impact real-time monitoring and incident response.
  • Cost considerations also exist but latency is often more critical for security.

Memory trick: Distance Delays Data Delivery.

More Manage security operations questions