Exam MD-102 All Questions

View all questions & answers for the MD-102 exam

Exam MD-102 topic 1 question 18 discussion

Actual exam question from Microsoft's MD-102

Question #: 18
Topic #: 1

You have computers that run Windows 10 and connect to an Azure Log Analytics workspace. The workspace is configured to collect all available events from the Windows event logs.
The computers have the logged events shown in the following table.

Which events are collected in the Log Analytics workspace?

A. 1 only
B. 2 and 3 only
C. 1 and 3 only
D. 1, 2, and 4 only
E. 1, 2, 3, and 4

Show Suggested Answer

Suggested Answer: E 🗳️

by Joe9011 at Aug. 16, 2023, 8:54 p.m.

Comments

Submit Cancel

letters1234

Highly Voted 1 year, 10 months ago

Selected Answer: D

Need to be careful of the wording as well. "Success" is not an event log type. Critical. Warning, Error, Information and Verbose are the event log types. There is Audit Success and Audit Failure in Security event logs (which cant be collected). But in the scenario, there is no 2 & 4 option, so D.

upvoted 17 times

...

mhmyz

Highly Voted 1 year, 8 months ago

Selected Answer: E

I think answer is E. Security events can be collected by Azure Monitor Agent and Data Collection rules. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent?tabs=portal

upvoted 15 times

NoursBear

1 year, 6 months ago

yes that's true but how do we know the Azure Monitor Agent is in use, it could be just the log analytics agent which is being deprecated 2024.

upvoted 1 times

NSA_Poker

1 year, 3 months ago

We know the Azure Monitor is in use by definition of the Log Analytics workspace. https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace-overview#:~:text=A%20Log%20Analytics%20workspace%20is%20a%20unique%20environment%20for%20log%20data%20from%20Azure%20Monitor%20and%20other%20Azure%20services%2C%20such%20as%20Microsoft%20Sentinel%20and%20Microsoft%20Defender%20for%20Cloud.

upvoted 1 times

SajjH

10 months, 2 weeks ago

Should be the key be the statement in the question, " The workspace is configured to collect all available events from the Windows event logs". The E is the correct answer.

upvoted 1 times

SajjH

10 months, 2 weeks ago

My bad, there is no Audit log in Windows Events, so D is correct.

upvoted 1 times

SajjH

10 months, 2 weeks ago

I mean Azure agent doesn't collect that

upvoted 1 times

...

theptr

Most Recent 3 days, 9 hours ago

Selected Answer: D

Event 3 (Security - Audit Success) → Not collected unless explicitly enabled

upvoted 1 times

...

8choxo

1 week, 1 day ago

Selected Answer: D

"Success" is not an event log type

upvoted 1 times

...

fabioperosa

3 weeks, 5 days ago

Selected Answer: E

https://learn.microsoft.com/en-us/azure/azure-monitor/vm/data-collection-windows-events

upvoted 1 times

...

dc0223a

1 month, 1 week ago

Selected Answer: E

Answer: E Explanation All events from Windows event logs are collected in the Log Analytics workspace, regardless of the event level or source. Therefore, events 1, 2, 3, and 4 are all collected in the workspace. References: https://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events

upvoted 2 times

...

HiddenQuest

3 months, 3 weeks ago

Selected Answer: E

The question is 'Which events are collected in the Log Analytics workspace?' Answer - Application + System + Security Events Therefore 1,2,3 and 4 is correct If you're thinking hmmm there is no Application Success event log type. Notice there is no option to select 2,3 and 4

upvoted 2 times

...

TedEx2

6 months, 2 weeks ago

Selected Answer: D

The Log Analytics agent is deprecated, but the question requires that. And based on the documentation, it is clear that the Log Analytics agent does not support the collection of security events directly https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events#configure-windows-event-logs. If the next update talk about Azure Monitor Agent, in this case it is possible.

upvoted 2 times

...

Alboo007_rs007

6 months, 2 weeks ago

Selected Answer: D

1. 2 .4 Only

upvoted 1 times

...

AleFCI1908

7 months, 2 weeks ago

Selected Answer: E

E can't log sec logs

upvoted 2 times

AleFCI1908

7 months, 2 weeks ago

sorry, I mean D

upvoted 1 times

...

AleFCI1908

7 months, 3 weeks ago

Selected Answer: D

cannot see security log in log analytics

upvoted 1 times

...

Nav90

7 months, 3 weeks ago

Selected Answer: E

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-windows-events#configure-windows-event-data-source

upvoted 1 times

...

Nav90

8 months ago

Answer is E, you can configure Data Collection Rule for Azure monitor to collect all events. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-windows-events

upvoted 1 times

...

TiagoFurtado

8 months ago

Selected Answer: E

check link https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-windows-events

upvoted 2 times

...

Alboo007_rs007

8 months, 1 week ago

Needs to be updated its: E

upvoted 2 times

...

martinods

8 months, 4 weeks ago

APP, SEC and SYS log can be configured https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-windows-events#configure-windows-event-data-source

upvoted 1 times

...

RomanV

9 months, 1 week ago

Shit is deprecated. It's now Azure Monitor Agent.

upvoted 1 times

RomanV

9 months, 1 week ago

Answer is D! Azure Monitor Agent (AMA) does not directly collect Audit Success and Audit Failure events from Windows Security event logs. Instead, it focuses on collecting broader event log types such as: Critical Warning Error Information Verbose To collect Audit Success and Audit Failure events, you would typically need to use other methods, such as: Azure Sentinel: For advanced security event collection and analysis, where you can configure data connectors to collect specific security events including audit logs.

upvoted 2 times

...

Load full discussion...