You need to implement alerts for the domain controllers. The solution must meet the technical requirements. What should you do on the domain controllers, and what should you create on Azure? To…

Question

Explanation

This question tests your ability to configure Azure Monitor-based alerting for on-premises domain controllers by combining an agent installed on the DCs with Azure-side resources that collect, store, and evaluate log data.

Approach. On the domain controllers, you install the Azure Monitor Agent (AMA). This agent is the modern replacement for the legacy Log Analytics (MMA) agent and streams security events, performance counters, and Windows Event logs to Azure. On the Azure side, you create two resources: (1) a Log Analytics Workspace - the central repository where the AMA sends all collected data - and (2) a Data Collection Rule (DCR) - which defines which data sources and event channels the agent collects from each DC and links them to the workspace. Once data flows into the workspace, you create Alert Rules in Azure Monitor (using KQL queries against the workspace) to trigger notifications when specific domain controller events occur, such as account lockouts, replication failures, or critical security events.

Concept tested. Azure Monitor Agent deployment on hybrid/on-premises servers (domain controllers) and the supporting Azure infrastructure - Log Analytics Workspace, Data Collection Rules, and Azure Monitor Alert Rules - required to implement end-to-end monitoring and alerting for Active Directory domain controllers.

Reference. Microsoft Learn: Monitor domain controllers with Azure Monitor - https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client

No community discussion yet for this question.