AZ-801 · Question #176
NOTE: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might…
The correct answer is A. Yes. Installing the Azure Connected Machine agent to enable Azure Arc management and then deploying the Azure Monitor Agent on the on-premises server is the correct modern solution for collecting Windows Firewall logs into Microsoft Sentinel.
Question
Options
- AYes
- BNo
How the community answered
(37 responses)- A92% (34)
- B8% (3)
Why each option
Installing the Azure Connected Machine agent to enable Azure Arc management and then deploying the Azure Monitor Agent on the on-premises server is the correct modern solution for collecting Windows Firewall logs into Microsoft Sentinel.
The solution correctly outlines the process for connecting an on-premises Windows Server to Microsoft Sentinel. The Azure Connected Machine agent enables the server to be managed as an Azure Arc resource, and the Azure Monitor Agent, deployed via an extension, then collects the specified Windows Firewall logs and forwards them to the Microsoft Sentinel workspace.
The provided solution is valid and effective for enabling Microsoft Sentinel to collect Windows Firewall logs from an on-premises server using the recommended modern agents and architecture.
Concept tested: Microsoft Sentinel data collection from on-premises servers (Azure Arc & AMA)
Source: https://learn.microsoft.com/en-us/azure/sentinel/connect-windows-firewall
Topics
Community Discussion
No community discussion yet for this question.