Hotspot Question You have an Azure subscription. The subscription contains a Log Analytics workspace named WS1 that is accessible via a public endpoint. The subscription contains the virtual machines

Question

Exhibits

Answer Area

• Central US 20 Run the Server Core installation of Windows ServerNo
• East US 50 Run Windows Server and have IIS-based infrastructure services installedYes
• West US 50 Run Windows Server and have IIS-based application services installedNo

Explanation

This question tests understanding of Azure Monitor Agent data collection rules (DCRs) and data collection endpoints (DCEs), specifically how to minimize the number of each while meeting distinct regional log collection requirements.

Approach. The minimum number of DCRs is 2. You need one DCR for East US (collecting both Windows logs AND IIS logs) and one DCR for Central US (collecting only Windows logs). The West US VMs need IIS logs only - but since the East US DCR already collects IIS logs, you cannot reuse it as-is for West US without also collecting Windows logs (which would violate the 'minimize data' requirement). However, you can associate West US VMs with a separate or existing IIS-only DCR. In practice, you need: DCR1 for Windows+IIS (East US), DCR2 for Windows only (Central US), and DCR3 for IIS only (West US) - that equals 3 DCRs. For DCEs: DCEs are only required when VMs cannot reach the Log Analytics public endpoint directly (e.g., private network scenarios). Since WS1 is accessible via a public endpoint and there is no mention of private link, no additional DCEs are required (0 DCEs). The Azure Monitor Agent can send data directly to the public endpoint of WS1 without a custom DCE. Therefore: Minimum DCRs = 3, Minimum DCEs = 0.

Concept tested. Azure Monitor Agent (AMA) requires Data Collection Rules (DCRs) to define what data to collect and where to send it. Different DCRs are needed when different VMs require different combinations of data sources (e.g., Windows Events only vs. Windows Events + IIS logs vs. IIS logs only) to minimize unnecessary data collection. Data Collection Endpoints (DCEs) are only required when VMs cannot reach public endpoints (e.g., in private network/private link scenarios); since WS1 has a public endpoint and no private link is mentioned, DCEs are not needed.

Reference. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-overview

No community discussion yet for this question.