Exam SC-100 topic 1 question 16 discussion

These answer options have been abridged. Other dumps say: A. Create a custom collector that uses the Log Analytics agent. B. Use the Azure Monitor agent with the multi-homing configuration. C. Implement resource-based role-based access control (RBAC) in Microsoft Sentinel. D. Configure Azure Active Directory (Azure AD) Conditional Access policies.

I agree with B & C after the expaned version of the answers

Custom collector when sources are API/3rd parties/Apps -> no A

To meet the specified requirements for the customer’s hybrid cloud infrastructure, the two solutions that should be included in the recommendation are: A. Custom Collector with Log Analytics Agent: This solution can collect security and operation logs from on-premises servers and send them to Microsoft Sentinel. The custom collector can be configured to ensure that the security operations team has access to both security and operation logs. C. Resource-Based RBAC: This allows for fine-grained access control. By implementing RBAC, you can ensure that the security operations team has access to security logs and operation logs, while the IT operations team has access only to the operation logs. Solutions B and D are not complete solutions for the requirements stated. The Azure Monitor agent (B) is primarily for data collection and doesn’t provide access control, while Azure AD Conditional Access policies (D) are used for managing access based on conditions and do not directly control log access.

A/C Custom Collector with Log Analytics Agent: Deploy a custom collector that utilizes the Log Analytics agent. This agent allows you to collect security logs and operation logs from various sources, including on-premises servers. By configuring custom collectors, the security operations team can access both security logs and operation logs. Points: 1 Resource-Based Role-Based Access Control (RBAC): Utilize Azure RBAC to create and assign roles within your security operations team. Assign appropriate roles to grant access to Microsoft Sentinel resources. For the IT operations team, assign roles that provide access only to operation logs (such as event logs from servers in the perimeter network). By fine-tuning RBAC, you ensure that each team has the necessary access without compromising security.

Requires splitting operation and security logs Use the Microsoft Monitor Agent or Azure Monitor Agent multi-home functionality

Really don't get the point of B. Why? It all depends on how you read the question. There is a need for 2 different teams to see the logs. -> RBAC Second part is only from the perimeter. I read this as the operation people need to be at a certain place before they can read it -> conditional access So I would go for C & D.

the actual multiple-choice answers did not make much sense until Plumpy pointed out the full wording.

A and B

what is Resource Based Access control?? Its Role based Access control,

I am sorry, maybe my understand is wrong. why B is the answer like C as a complete solution? the Question condition is "Each correct answer presents a complete solution". I think that Azure Monitor agent is needed of cause, but it is for collecting the log data, doesn't meet the solution's requirements to control access. If the question condition is "Each correct answer presents part of the solution", I will agree with B & C.

AC is the answer. https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources#custom-logs For some data sources, you can collect logs as files on Windows or Linux computers using the Log Analytics custom log collection agent. https://learn.microsoft.com/en-us/azure/sentinel/resource-context-rbac Typically, users who have access to a Microsoft Sentinel workspace also have access to all the workspace data, including security content. Administrators can use Azure roles to configure access to specific features in Microsoft Sentinel, depending on the access requirements in their team.

B: Tricky one, no internet on on-premise servers, you need to use the Log Analytics gateway in Azure Monitor. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/gateway C: RBAC

The legacy Log Analytics agent will be deprecated by August 2024, Microsoft recommends to migrate/use Azure Monitor Agent. So if both Log analytics agent and Azure monitor Agents are there in the answer choose the latter.

A. a custom collector that uses the Log Analytics agent C. resource-based role-based access control (RBAC)

I agree With the answers, but the explanation is very poor. I would really improve on that.

A & C is the right answer