nerdexam
Microsoft

AZ-801 · Question #176

NOTE: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might…

The correct answer is A. Yes. Installing the Azure Connected Machine agent to enable Azure Arc management and then deploying the Azure Monitor Agent on the on-premises server is the correct modern solution for collecting Windows Firewall logs into Microsoft Sentinel.

Secure Windows Server on-premises and hybrid infrastructures

Question

NOTE: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an on-premises server named Server1 that runs Windows Server. You have a Microsoft Sentinel instance. You add the Windows Firewall data connector in Microsoft Sentinel. You need to ensure that Microsoft Sentinel can collect Windows Firewall logs from Server1. Solution: You install the Azure Connected Machine agent and Azure Monitor Agent for Windows extension on Server1. Does this meet the goal?

Options

  • AYes
  • BNo

How the community answered

(37 responses)
  • A
    92% (34)
  • B
    8% (3)

Why each option

Installing the Azure Connected Machine agent to enable Azure Arc management and then deploying the Azure Monitor Agent on the on-premises server is the correct modern solution for collecting Windows Firewall logs into Microsoft Sentinel.

AYesCorrect

The solution correctly outlines the process for connecting an on-premises Windows Server to Microsoft Sentinel. The Azure Connected Machine agent enables the server to be managed as an Azure Arc resource, and the Azure Monitor Agent, deployed via an extension, then collects the specified Windows Firewall logs and forwards them to the Microsoft Sentinel workspace.

BNo

The provided solution is valid and effective for enabling Microsoft Sentinel to collect Windows Firewall logs from an on-premises server using the recommended modern agents and architecture.

Concept tested: Microsoft Sentinel data collection from on-premises servers (Azure Arc & AMA)

Source: https://learn.microsoft.com/en-us/azure/sentinel/connect-windows-firewall

Topics

#Microsoft Sentinel#Azure Monitor Agent#Azure Arc#Hybrid Monitoring

Community Discussion

No community discussion yet for this question.

Full AZ-801 Practice