Correct Answer: D
When designing Azure Monitor logs deployment, you need to consider the following factors: The company presence — does the company need to store data in different regions or not.
Costs of the outbound data transfers — can you keep the Azure resource data in the same region as the resources.
The data consumption pattern — does every department in the organization require accessing their data only.
Based on the evolution of these factors, you can define the number of the required Log Analytics workspaces and their placements. You can deploy workspaces in a centralized, decentralized, or hybrid way.
The centralized deployment creates the central workspace with Azure Monitor data access management by the team or department. This is the most straightforward approach to manage the data.
The decentralized model provides workspaces for each group, and the log data is divided by resources. The data silos create difficulties for cross-team data manipulation but make data access more secure.
And the hybrid model is the parallel implementation of the models mentioned above.
Azure provides two options for workspace data access: Workspace-context and Resource-context.
When you use the Azure Monitor Logs menu, you access the data in a workspace-context mode. If you access logs within the Azure resource blade under the Monitoring section, you access the data in a resource-context mode. This mode helps you to define Azure RBAC with full granularity.
Typically, the organization’s application teams need access to the resource logs for their activities. Therefore, you need to define the resource-context type access for them.
All other options are incorrect.
For more information about Azure Monitor Logs deployment, please visit the below URLs:
https://docs.microsoft.com/en-us/azure/azure-monitor/logs/design-logs-deployment
https://docs.microsoft.com/en-us/azure/azure-monitor/logs/manage-access