SC-100 Certification Practice Question #96

Question

You have multiple on-premises Hyper-V hosts that contain virtual machines. The virtual machines run Windows Server 2022.

You have an Azure subscription.

You need to recommend a solution to collect Security event logs from the virtual machines by using Microsoft Sentinel. The Solution must meet the following requirements:

•	Leverage the Windows Security Events via AMA data connector.
•	Ensure that only specific events are collected.
•	Minimize costs.

What should you recommend? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one port.

Accepted Answer

The Windows Security Events via AMA connector requires the Azure Monitor Agent, but AMA can only be pushed to a machine that Azure can manage. On-premises Hyper-V VMs are non-Azure, so MS Learn requires the Azure Connected Machine agent (Azure Arc) be installed first — this is the prerequisite that lets AMA be deployed. The "Log Analytics agent" option named in some comments (MMA) is the deprecated/retired agent and cannot serve the AMA connector, so it is eliminated despite the votes. For collecting "only specific events" while minimizing cost, a Data Collection Rule with a Custom (XPath) selection is the mechanism that filters events at ingestion, making DCR the row-1 answer over data collection endpoints or Defender for Cloud settings. The HOTSPOT is confidently resolved at 86% — strong MS Learn grounding plus the top-voted comment (reyreyg, 4 👍) — with confidence trimmed by the community split between the deprecated Log Analytics agent and the Arc agent.

More SC-100 practice questions