AZ-305 Question 54

Question

HOTSPOT You have five Azure subscriptions. Each subscription is linked to a separate Azure AD tenant and contains virtual machines that run Windows Server 2022. You plan to collect Windows security events from the virtual machines and send them to a single Log Analytics workspace. You need to recommend a solution that meets the following requirements:
• Collects event logs from multiple subscriptions
• Supports the use of data collection rules (DCRs) to define which events to collect What should you recommend for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Accepted Answer

Hotspot Solution:
### Recommended Community Solution:
This seems a bit confusing question. Azure light house is needed for multitenant management. As per documentation, it says log analytics workspace should be created at each tenant, and then "You can run log queries to retrieve data across Log Analytics workspaces in different customer tenants by creating a union that includes multiple workspaces. " . But in the question it says all logs need to be ingested to a single workspace. I would go for "Azure lighthouse" for the first one since eventgrid and purview are not related to the topic. Azure monitoring agent cannot natively send logs to event grid. 2nd answer is Azure monitoring agent.

AZ-305 Question 54

Preparing Practice Exam…

AZ-305 Question 54

Explanation

Recommended Community Solution:

Community Discussion