AZ-104 Certification Practice Question #277

Question

You have an Azure subscription that contains two Log Analytics workspaces named Workspace1 and Workspace2 and 100 virtual machines that run Windows Server.

You need to collect performance data and events from the virtual machines. The solution must meet the following requirements:

•	Logs must be sent to Workspace1 and Workspace 2.
•	All Windows events must be captured.
•	All security events must be captured.

What should you install and configure on each virtual machine?

Accepted Answer

The Azure Monitor Agent (AMA) is the modern agent for collecting guest operating system metrics and logs. It uses Data Collection Rules (DCRs) to specify what data to collect and where to send it. Through DCRs, AMA supports sending VM logs and performance data to multiple Log Analytics workspaces (multi-homing) simultaneously, satisfying the requirement to send logs to both Workspace1 and Workspace2. Additionally, AMA is designed to capture Windows event logs and security event logs. WAD primarily targets Azure Storage, and the Windows VM agent does not collect guest telemetry.

More AZ-104 practice questions