Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Cybersecurity Architect Expert · Microsoft
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
A. A custom collector that uses the Log Analytics agent The perimeter servers cannot connect directly to the internet. A collector can receive or gather their Windows event logs and forward the data to the Log Analytics workspace used by Microsoft Sentinel. This allows the IT operations team to access the perimeter servers’ operational logs without requiring each server to have direct internet connectivity. C. Resource-based role-based access control (RBAC) Resource-context RBAC lets access be scoped according to the resources that produced the data: The security operations team can be granted workspace-level access, allowing it to see both security and operational logs. The IT operations team can be granted access only to the relevant server resources, limiting it to those resources’ operational and event logs. Microsoft specifically identifies resource-context RBAC as appropriate when a non-security team must see Windows event data for the servers it manages without receiving access to the entire Microsoft Sentinel workspace.
Correct Answers: A and C Perimeter servers cannot reach the internet, so they cannot use the Azure Monitor Agent (AMA), which requires outbound connectivity. A custom log collector using the legacy Log Analytics agent can forward logs through a proxy or log forwarder that does have internet access. RBAC lets you control who can see which logs in Microsoft Sentinel.
The two solutions to include are: A. a custom collector that uses the Log Analytics agent C. resource-based role-based access control (RBAC)