Exam MD-102 All Questions

View all questions & answers for the MD-102 exam

Exam MD-102 topic 1 question 18 discussion

Actual exam question from Microsoft's MD-102

Question #: 18
Topic #: 1

You have computers that run Windows 10 and connect to an Azure Log Analytics workspace. The workspace is configured to collect all available events from the Windows event logs.
The computers have the logged events shown in the following table.

Which events are collected in the Log Analytics workspace?

A. 1 only
B. 2 and 3 only
C. 1 and 3 only
D. 1, 2, and 4 only
E. 1, 2, 3, and 4

Show Suggested Answer

Suggested Answer: E 🗳️

by Joe9011 at Aug. 16, 2023, 8:54 p.m.

Comments

Submit Cancel

letters1234

Highly Voted 1 year, 11 months ago

Selected Answer: D

Need to be careful of the wording as well. "Success" is not an event log type. Critical. Warning, Error, Information and Verbose are the event log types. There is Audit Success and Audit Failure in Security event logs (which cant be collected). But in the scenario, there is no 2 & 4 option, so D.

upvoted 17 times

...

mhmyz

Highly Voted 1 year, 9 months ago

Selected Answer: E

I think answer is E. Security events can be collected by Azure Monitor Agent and Data Collection rules. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent?tabs=portal

upvoted 16 times

NoursBear

1 year, 8 months ago

yes that's true but how do we know the Azure Monitor Agent is in use, it could be just the log analytics agent which is being deprecated 2024.

upvoted 1 times

NSA_Poker

1 year, 4 months ago

We know the Azure Monitor is in use by definition of the Log Analytics workspace. https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace-overview#:~:text=A%20Log%20Analytics%20workspace%20is%20a%20unique%20environment%20for%20log%20data%20from%20Azure%20Monitor%20and%20other%20Azure%20services%2C%20such%20as%20Microsoft%20Sentinel%20and%20Microsoft%20Defender%20for%20Cloud.

upvoted 1 times

SajjH

1 year ago

Should be the key be the statement in the question, " The workspace is configured to collect all available events from the Windows event logs". The E is the correct answer.

upvoted 1 times

SajjH

1 year ago

My bad, there is no Audit log in Windows Events, so D is correct.

upvoted 1 times

SajjH

1 year ago

I mean Azure agent doesn't collect that

upvoted 1 times

...

theptr

Most Recent 1 month, 3 weeks ago

Selected Answer: D

Event 3 (Security - Audit Success) → Not collected unless explicitly enabled

upvoted 2 times

...

8choxo

2 months ago

Selected Answer: D

"Success" is not an event log type

upvoted 1 times

...

fabioperosa

2 months, 2 weeks ago

Selected Answer: E

https://learn.microsoft.com/en-us/azure/azure-monitor/vm/data-collection-windows-events

upvoted 1 times

...

dc0223a

2 months, 4 weeks ago

Selected Answer: E

Answer: E Explanation All events from Windows event logs are collected in the Log Analytics workspace, regardless of the event level or source. Therefore, events 1, 2, 3, and 4 are all collected in the workspace. References: https://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events

upvoted 2 times

...

HiddenQuest

5 months, 2 weeks ago

Selected Answer: E

The question is 'Which events are collected in the Log Analytics workspace?' Answer - Application + System + Security Events Therefore 1,2,3 and 4 is correct If you're thinking hmmm there is no Application Success event log type. Notice there is no option to select 2,3 and 4

upvoted 3 times

...

TedEx2

8 months ago

Selected Answer: D

The Log Analytics agent is deprecated, but the question requires that. And based on the documentation, it is clear that the Log Analytics agent does not support the collection of security events directly https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events#configure-windows-event-logs. If the next update talk about Azure Monitor Agent, in this case it is possible.

upvoted 2 times

...

Alboo007_rs007

8 months, 1 week ago

Selected Answer: D

1. 2 .4 Only

upvoted 1 times

...

AleFCI1908

9 months, 1 week ago

Selected Answer: E

E can't log sec logs

upvoted 2 times

AleFCI1908

9 months, 1 week ago

sorry, I mean D

upvoted 1 times

...

AleFCI1908

9 months, 2 weeks ago

Selected Answer: D

cannot see security log in log analytics

upvoted 1 times

...

Nav90

9 months, 2 weeks ago

Selected Answer: E

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-windows-events#configure-windows-event-data-source

upvoted 1 times

...

Nav90

9 months, 3 weeks ago

Answer is E, you can configure Data Collection Rule for Azure monitor to collect all events. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-windows-events

upvoted 1 times

...

TiagoFurtado

9 months, 3 weeks ago

Selected Answer: E

check link https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-windows-events

upvoted 2 times

...

Alboo007_rs007

10 months ago

Needs to be updated its: E

upvoted 2 times

...

martinods

10 months, 2 weeks ago

APP, SEC and SYS log can be configured https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-windows-events#configure-windows-event-data-source

upvoted 1 times

...

RomanV

11 months ago

Shit is deprecated. It's now Azure Monitor Agent.

upvoted 1 times

RomanV

11 months ago

Answer is D! Azure Monitor Agent (AMA) does not directly collect Audit Success and Audit Failure events from Windows Security event logs. Instead, it focuses on collecting broader event log types such as: Critical Warning Error Information Verbose To collect Audit Success and Audit Failure events, you would typically need to use other methods, such as: Azure Sentinel: For advanced security event collection and analysis, where you can configure data connectors to collect specific security events including audit logs.

upvoted 2 times

...

Load full discussion...