nerdexam
Microsoft

AZ-801 · Question #173

You have 20 on-premises virtual machines that run Windows Server. You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1. You need to collect events from the…

The correct answer is C. the Azure Monitor agent. To collect filtered events from on-premises Windows Server VMs to Microsoft Sentinel, the Azure Monitor agent must be installed on each VM, as it utilizes data collection rules for granular event filtering.

Monitor and troubleshoot Windows Server environments

Question

You have 20 on-premises virtual machines that run Windows Server. You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1. You need to collect events from the on-premises virtual machines and end forward the events to Workspace1. The solution must ensure that you can define filters to minimize the volume of collected events. Which two components should you install on each virtual machine? Each correct answer represents part of the solution. NOTE: Each correct selection is worth one point.

Options

  • Athe Azure Connected Machine agent
  • Bthe Azure VM Dependency agent extension for Windows
  • Cthe Azure Monitor agent
  • Dthe Log Analytics VM extension for Windows
  • Ethe Dependency agent

How the community answered

(26 responses)
  • A
    4% (1)
  • B
    15% (4)
  • C
    73% (19)
  • E
    8% (2)

Why each option

To collect filtered events from on-premises Windows Server VMs to Microsoft Sentinel, the Azure Monitor agent must be installed on each VM, as it utilizes data collection rules for granular event filtering.

Athe Azure Connected Machine agent

The Azure Connected Machine agent (Azure Arc agent) connects on-premises machines to Azure management, which is often a prerequisite for deploying AMA, but it does not itself collect events with filtering capabilities for Sentinel.

Bthe Azure VM Dependency agent extension for Windows

The Azure VM Dependency agent extension is primarily for collecting process dependency data for Service Map and Azure Monitor for VMs, not for general event collection with filtering to Sentinel, and it is intended for Azure VMs.

Cthe Azure Monitor agentCorrect

The Azure Monitor agent (AMA) is the modern agent for collecting logs and metrics to Azure Monitor and Microsoft Sentinel. It uses Data Collection Rules (DCRs) which allow for precise filtering of events, directly addressing the requirement to minimize the volume of collected events.

Dthe Log Analytics VM extension for Windows

The Log Analytics VM extension installs the legacy Microsoft Monitoring Agent (MMA), which is being deprecated. While it collects events, the Azure Monitor agent (AMA) with DCRs offers superior and more flexible filtering capabilities for new deployments.

Ethe Dependency agent

The Dependency agent is a generic term; it's not the primary agent for collecting filtered events to Sentinel, and option B specifies the Azure version.

Concept tested: Azure Monitor Agent for Sentinel data collection

Source: https://learn.microsoft.com/en-us/azure/sentinel/connect-windows-security-events

Topics

#Azure Monitor Agent#Azure Arc#Log Collection#Hybrid Management

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-801 Practice