Hotspot Question You have five Azure subscriptions. Each subscription is linked to a separate Azure AD tenant and contains virtual machines that run Windows Server 2022. You plan to collect Windows…

This question tests knowledge of Azure Monitor Agent (AMA) and its ability to collect security events across multiple subscriptions and Azure AD tenants using Data Collection Rules (DCRs).

Submitted by thandi_sa· Mar 6, 2026Design identity, governance, and monitoring solutions

Question

Hotspot Question You have five Azure subscriptions. Each subscription is linked to a separate Azure AD tenant and contains virtual machines that run Windows Server 2022. You plan to collect Windows security events from the virtual machines and send them to a single Log Analytics workspace. You need to recommend a solution that meets the following requirements: - Collects event logs from multiple subscriptions - Supports the use of data collection rules (DCRs) to define which events to collect What should you recommend for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibit

Answer Area

To collect the event logs:
Azure Event GridAzure LighthouseAzure Purview
To support the DCRs:
The Log Analytics agentThe Azure Monitor agentThe Azure Connected Machine agent

Explanation

This question tests knowledge of Azure Monitor Agent (AMA) and its ability to collect security events across multiple subscriptions and Azure AD tenants using Data Collection Rules (DCRs).

Approach. The correct recommendation is to use the Azure Monitor Agent (AMA) for event collection and Data Collection Rules (DCRs) to define which events to collect. AMA supports multi-subscription and multi-tenant scenarios by allowing the agent to send data to a Log Analytics workspace in a different subscription or tenant, making it ideal for centralized logging. DCRs are a native feature of AMA that allow granular control over what data is collected (e.g., specific Windows Event Log channels and severity levels), which directly satisfies the requirement. The older Microsoft Monitoring Agent (MMA/Log Analytics Agent) uses workspace configuration rather than DCRs and is being deprecated, making AMA the correct modern choice.

Concept tested. Azure Monitor Agent (AMA) with Data Collection Rules (DCRs) for centralized, cross-subscription, and cross-tenant Windows security event log collection into a single Log Analytics workspace.

Reference. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview

Topics

#Log Analytics#Azure Monitor Agent#Data Collection Rules#Azure Lighthouse

Community Discussion

No community discussion yet for this question.

Full AZ-305 Practice