Exam SC-200 topic 4 question 23 discussion

Actual exam question from Microsoft's SC-200

Question #: 23
Topic #: 4

HOTSPOT
-

Your on-premises network contains a Hyper-V cluster. The cluster contains the virtual machines shown in the following table.

You have a Microsoft Sentinel workspace named SW1.

You have a data collection rule (DCR) that has the following configurations:

• Name: DCR1
• Destination: SW1
• Platform type: All
• Data collection endpoint: None
• Data source: Windows event logs, Linux syslog

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by Blasty at Feb. 24, 2025, 1:36 p.m.

Comments

Submit Cancel

ErikGrabben

6 days, 8 hours ago

ARC is a requisite for AMA agent when it comes to on-prem

upvoted 1 times

...

HAjouz

1 month, 4 weeks ago

Answer is correct - to protect you need Machine agent - to Monitor you need AMA previously known as Log analytics agent.

upvoted 1 times

...

Blasty

2 months ago

I am not entirely sure this is correct. You need the Azure Monitor Agent to add your VMs as a Data Source in Azure for Data Collection Rules. However, when installing the Azure Connected Machine Agent (ACMA) the Azure Monitor Windows Agent is installed as one of the extension within the ACMA package. Therefore I would assume that all VMs listed would be able to be send their Windows Events & Linux Syslog via DCR to the respective Log Analytics Workspace. Log Analytics Workspaces > yourUniqueWorkspace | Agents > Data collection rules > yourUniqueDCR https://learn.microsoft.com/en-us/azure/azure-arc/servers/agent-overview

upvoted 1 times

...

Exam SC-200 All Questions

View all questions & answers for the SC-200 exam

Exam SC-200 topic 4 question 23 discussion

Comments

ErikGrabben

HAjouz

Blasty

SY0-701