You have three on-premises servers named Server1, Server2, and Server3 that run Windows. Server1 and Server2 and located on the Internal network. Server3 is located on the premises network. All…

Question

Options

• ACreate an event subscription from Server1, Server2 and Server3
• BInstall the On-premises data gateway on each server.
• CInstall the Microsoft Agent on each server.
• DInstall the Microsoft Agent on Server1 and Server2 install the on-premises data gateway on Server3.

• A
  4% (1)
• C
  88% (23)
• D
  8% (2)

Explanation

Explanation

Installing the Microsoft Monitoring Agent (MMA/Log Analytics Agent) on each server is the correct approach because the Windows Firewall data connector in Microsoft Sentinel specifically requires this agent to collect and forward Microsoft Defender Firewall event logs to the Log Analytics workspace - this applies uniformly to all servers regardless of their network location (Internal or on-premises), as long as they have Azure connectivity.

Why the distractors are wrong:

• Option A is incorrect because event subscriptions are used for Windows Event Forwarding (WEF) between Windows machines, not for sending data to Azure Sentinel.
• Option B is incorrect because the On-premises data gateway is used for services like Power BI or Azure Logic Apps to connect to on-premises data sources - it is not the mechanism for Sentinel data collection.
• Option D is incorrect because it creates an unnecessary distinction between servers; since all three servers have Azure access, all three only need the Microsoft Monitoring Agent - no server requires the on-premises data gateway for this purpose.

Memory Tip: Think "Sentinel sees through Agents" - whenever Azure Sentinel needs to collect data from Windows servers (regardless of location), your first instinct should be to install the Microsoft Monitoring Agent on every target server.

No community discussion yet for this question.