AZ-801 · Question #144
You have an on-premises server named Server1 that runs Windows Server. You have a Microsoft Sentinel instance. You add the Windows Firewall data connector in Microsoft Sentinel. You need to ensure tha
The correct answer is A. Yes. Installing the Log Analytics agent on Server1 meets the goal of collecting Windows Firewall logs in Microsoft Sentinel, as the agent is essential for data ingestion from Windows machines.
Question
Exhibit
Options
- AYes
- BNo
How the community answered
(37 responses)- A86% (32)
- B14% (5)
Why each option
Installing the Log Analytics agent on Server1 meets the goal of collecting Windows Firewall logs in Microsoft Sentinel, as the agent is essential for data ingestion from Windows machines.
The Log Analytics agent (also known as the Microsoft Monitoring Agent - MMA) is the primary method for collecting logs and performance data from Windows machines, including Windows Firewall logs, and forwarding them to a Log Analytics workspace, which serves as the data backend for Microsoft Sentinel.
This option states "No", which is incorrect because installing the Log Analytics agent is the correct solution for collecting Windows Firewall logs for Microsoft Sentinel.
Concept tested: Sentinel Windows Firewall Log Analytics agent
Source: https://learn.microsoft.com/en-us/azure/sentinel/connect-windows-firewall
Topics
Community Discussion
No community discussion yet for this question.
