Exam MD-101 topic 3 question 90 discussion

Actual exam question from Microsoft's MD-101

Question #: 90
Topic #: 3

You have computers that run Windows 10 and connect to an Azure Log Analytics workspace. The workspace is configured to collect all available events from the Windows event logs.

The computers have the logged events shown in the following table.

Which events are collected in the Log Analytics workspace?

A. 1 only
B. 2 and 3 only
C. 1 and 3 only
D. 1, 2, and 4 only
E. 1, 2, 3, and 4

Show Suggested Answer

Suggested Answer: D 🗳️

by ChrisC21 at April 14, 2023, 1:56 a.m.

Comments

Submit Cancel

Amir1909

1 year, 5 months ago

Correct

upvoted 1 times

...

bassfunk

1 year, 11 months ago

Selected Answer: D

"Azure Monitor doesn't collect audit events created by SQL Server from source MSSQLSERVER with event ID 18453 that contains keywords Classic or Audit Success and keyword 0xa0000000000000." So wouldn't you select D and not C?

upvoted 1 times

...

vanr2000

2 years ago

Selected Answer: C

This is the reason why: "Azure Monitor doesn't collect audit events created by SQL Server from source MSSQLSERVER with event ID 18453 that contains keywords Classic or Audit Success and keyword 0xa0000000000000." https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events

upvoted 1 times

...

ChrisC21

2 years, 2 months ago

Seems right. "You can't configure collection of security events from the workspace by using the Log Analytics agent. You must use Microsoft Defender for Cloud or Microsoft Sentinel to collect security events. The Azure Monitor agent can also be used to collect security events." https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events

upvoted 1 times

...