Exam MD-100 topic 5 question 41 discussion

Actual exam question from Microsoft's MD-100

Question #: 41
Topic #: 5

Your network contains an Active Directory domain. The domain contains 10 computers that run Windows 10.
On a different computer named Computer1, you plan to create a collector-initiated subscription to gather the event logs from the Windows 10 computers.
You need to configure the environment to support the event log collection.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Add Computer1 to the Event Log Readers group on the Windows 10 computers
B. Add Computer1 to the Event Log Readers group on Computer1
C. On the Windows 10 computers, change the Startup Type of Windows Event Collector to Automatic
D. Enable Windows Remote Management (WinRM) on the Windows 10 computers
E. Enable Windows Remote Management (WinRM) on Computer1

Show Suggested Answer

Suggested Answer: AD 🗳️
Reference:
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc748890(v=ws.11)

by cubalondon at Jan. 27, 2021, 11:04 p.m.

Comments

Submit Cancel

cubalondon

Highly Voted 4 years, 4 months ago

To configure computers in a domain to forward and collect events 1. Log on to all collector and source computers. It is a best practice to use a domain account with administrative privileges. 2. On each source computer, type the following at an elevated command prompt: winrm quickconfig On the collector computer, type the following at an elevated command prompt wecutil qc

upvoted 7 times

AVP_Riga

4 years, 2 months ago

and Add the computer account of the collector computer to the Event Log Readers Group on each of the source computers.

upvoted 5 times

...

AVP_Riga

Highly Voted 4 years, 2 months ago

A and D. C is partly correct.

upvoted 7 times

...

KAM2023

Most Recent 1 year, 9 months ago

C. On the Windows 10 computers, change the Startup Type of Windows Event Collector to Automatic: This ensures that the Windows Event Collector service is running and ready to collect events. D. Enable Windows Remote Management (WinRM) on the Windows 10 computers: WinRM is required for remote event log collection. You need to enable it on the Windows 10 computers so that they can communicate with Computer1.

upvoted 1 times

...

PChi

3 years, 2 months ago

Given answers are correct. After you setup the source computer (run winrm qc then add the collector computer to the Event Log Readers group), go to the collector computer and run wecutil qc to configure the collector service. After, go to the event viewer, run as an admin and create the subscription (set to forwarded events). Don't forget to set as a collector initiated subscription. Taken from Testout Client Pro 11.2.5 Configuring Collector-initiated Subscriptions

upvoted 3 times

...

AS007

3 years, 7 months ago

C. On the Windows 10 computers, change the Startup Type of Windows Event Collector to Automatic D. Enable Windows Remote Management (WinRM) on the Windows 10 computers

upvoted 1 times

...