Exam MD-102 topic 1 question 25 discussion

Answer id BCD: - A: No security-event loggings in LogAnalytics Agent (MMA) - B: the list of processes and their execution times: Yes, try it if you want in LogAnalytics: Perf | where ObjectName == "Process" and CounterName == "% Processor Time" You will see all processes of all the computers and their run time. - C: the average processor utilization: Yes, run: InsightsMetrics | where Origin == "vm.azm.ms" | where Namespace == "Processor" and Name == "UtilizationPercentage" D: Yes, Systemlogs are collected. E: Log files apart from Application and System logs are NOT collected. For sure not if they are text-based log files. Only Eventlogs. No textfiles.

Most Accurate and Updated Answers (2025): A. Failure events from the Security log → ✅ (now supported via AMA) C. Average processor utilization → ✅ (always supported via performance counters) D. Error events from the System log → ✅ (supported via event log collection) ❗ Why Are Answers Online So Varied? Outdated agent models: Most confusion is due to the transition from MMA (Log Analytics agent) to AMA (Azure Monitor Agent), which has far more granular control over data collection. Custom logs (E) require manual configuration, so some people incorrectly rule them out entirely. Process info (B) is misleading — while some performance counters are available per process, actual execution time logging is not a default feature of Log Analytics.

The answer is C guys. Administrative template (A) has been retired

As today you can collect security logs using the Azure Log Analytics, I think it can be ACDE.

C: Perf | where ObjectName == "Processor" and CounterName == "% Processor Time" and InstanceName == "_Total" | summarize AVGCPU = avg(CounterValue) by Computer Average CPU utilization across all computers https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-performance-counters D: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-syslog E: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-custom-logs

The Log Analytics agent itself does not natively collect detailed process information, such as a list of processes and their execution times, without additional configuration. B is wrong.

C: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-performance-counters#log-queries-with-performance-records D: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-syslog E: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-custom-logs

Security Log Events: Log Analytics can collect various types of events from the Security log, which includes failure events. This is useful for monitoring security-related incidents on your devices. Processor Utilization: Performance data, such as average processor utilization, can be collected to monitor the performance and health of your devices. System Log Events: Error events from the System log can be collected to help diagnose and troubleshoot issues on your devices. Options B and E are not correct because Log Analytics does not natively collect detailed process execution times or third-party application logs stored as text files without additional configuration or custom log collection setups. correct answers are: A, C, D

B. the list of processes and their execution times C. the average processor utilization E. third-party application logs stored as text files

The three types of data that you can collect from the computers using Azure Log Analytics are: B. the list of processes and their execution times: Log Analytics can collect process-related information, including details about running processes and their resource consumption. C. the average processor utilization: Log Analytics can capture performance-related data, such as CPU utilization metrics, which can include averages over time. D. error events from the System log: Log Analytics can gather events from Windows Event Logs, including error events from the System log, providing insights into system-level issues and errors. Therefore, the correct selections are: B. the list of processes and their execution times C. the average processor utilization D. error events from the System log

It's probably outdated and you won't see those exact answers on the exam. MMA is being replaced with AMA and it does collect custom text logs ( https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-text-log?WT.mc_id=AZ-MVP-5000120&tabs=portal ).

See comment from HvD.

BCD List of processes and their execution times Average processor utilization (these are performance metrics and easily captured by Log Analytics) Error events from System log

BCD - I've set this up in a Log Analytics Workspace and tried it myself.

CDE Windows Event logs Information sent to the Windows event logging system Syslog Information sent to the Linux event logging system Performance Numerical values measuring performance of different aspects of operating system and workloads IIS logs Usage information for IIS websites running on the guest operating system Custom logs Events from text files on both Windows and Linux computers https://learn.microsoft.com/en-us/azure/azure-monitor/agents/log-analytics-agent

seems correct

not sure that 3rd party logs can be collected by default, you need SIEM integration / Sentinel Log Analytics documentation dont say much about 3rd party log collection i would go with BCD