Microsoft Security Operations AnalystMitigate threats using Microsoft SentinelHard
A security architect is designing a Microsoft Sentinel deployment and needs to ensure data residency requirements are met for all ingested logs. The organization operates globally but must keep all data for its European branches within the EU. How can the architect ensure that logs from EU-based resources are stored exclusively in a Log Analytics workspace located in an EU region?
- AConfigure a single global Log Analytics workspace and rely on Azure's default routing.
- BEnable geo-redundant storage for the Log Analytics workspace to ensure compliance.
- CDeploy separate Log Analytics workspaces in the respective geographical regions and connect EU resources only to the EU workspace.
- DUse Azure Policy to force all data to be routed to the nearest Log Analytics workspace.
Show answer & explanationAnswer & explanation
Correct answer: C. Deploy separate Log Analytics workspaces in the respective geographical regions and connect EU resources only to the EU workspace.
To enforce data residency, separate Log Analytics workspaces must be deployed in the required geographical regions. Resources (like VMs, Azure services) are then configured to send their logs only to the workspace located in the compliant region, directly addressing the EU data residency requirement.
Why the other options are wrong
- A. A single global workspace would not guarantee data residency for specific regions, as data could be stored anywhere.
- B. Geo-redundant storage (GRS) provides data durability by replicating data to a secondary region, but it does not guarantee that the primary storage region itself is compliant with a specific data residency requirement, nor does it prevent the primary from being outside the desired region if initially configured incorrectly.
- D. Azure Policy can enforce workspace location for new deployments but does not automatically re-route data from existing resources to the 'nearest' workspace in a residency-compliant way without explicit configuration per resource.
Microsoft Sentinel Data Residency
The requirement for an organization to store its data within specific geographic boundaries (e.g., a country or region) to comply with legal or regulatory obligations.
- Achieved by deploying Log Analytics workspaces in the desired Azure region.
- Resources must be configured to send data to the appropriate regional workspace.
- Crucial for compliance with regulations like GDPR.
Memory trick: Think of data residency like 'national borders' – data must stay within its assigned territory.