Microsoft Security Operations AnalystMitigate threats using Microsoft SentinelEasy
A security architect is designing a Microsoft Sentinel deployment for an organization with strict data residency requirements. All security logs, including those ingested into Microsoft Sentinel, must remain within a specific geographic region (e.g., 'West Europe') at all times. How can the architect ensure this data residency for the ingested logs?
- AEnable data encryption at rest and in transit for all ingested data.
- BConfigure the Microsoft Sentinel workspace to use a geo-redundant storage account in the specified region.
- CDeploy the Log Analytics workspace and Microsoft Sentinel instance in the required geographic region.
- DUtilize Azure Policy to enforce data residency for all data connectors.
Show answer & explanationAnswer & explanation
Correct answer: C. Deploy the Log Analytics workspace and Microsoft Sentinel instance in the required geographic region.
The primary control for data residency in Microsoft Sentinel is the location of the underlying Log Analytics workspace. Deploying both the Log Analytics workspace and the Microsoft Sentinel resource within the desired geographic region ensures that all ingested logs remain within that region.
Why the other options are wrong
- A. Encryption ensures data security but does not dictate or guarantee the physical geographic location of the data storage.
- B. Geo-redundant storage (GRS) replicates data to a secondary region, which violates strict single-region residency requirements.
- D. While Azure Policy can enforce configurations, it doesn't directly control the physical storage location of ingested data if the workspace itself is in the wrong region.
Microsoft Sentinel Data Residency
Data residency in Microsoft Sentinel is primarily determined by the geographic location of the Log Analytics workspace where the security logs are stored.
- Logs are stored in the region of the Log Analytics workspace.
- Microsoft Sentinel itself is deployed into a Log Analytics workspace.
- Choose the region carefully during deployment to meet compliance.
Memory trick: Region's the Rule: Where Your Workspace Resides, Your Data Abides!