AZ-104 Practice Question 60: Azure Monitor Agent DCR
Microsoft Azure Administrator Associate (AZ-104) · Test 6 · question 10 of 10
An administrator must collect Windows event logs and Linux syslog from 50 VMs into a Log Analytics workspace. The collection settings, such as which event logs and which severities, must be managed in one place and applied to the VMs without editing each machine. The company will not use agents that are deprecated.
What should the administrator do?
Show answer and explanation
Answer:
The Azure Monitor Agent (AMA) is the current agent for collecting guest operating system data. What it collects is defined in a data collection rule (DCR), which lists data sources such as Windows event logs and syslog facilities and levels, plus the destination workspace. Associating one DCR with many VMs applies the same configuration to all of them and lets it be changed centrally.
Option B captures serial console and screenshot output for troubleshooting a VM that will not boot. It does not collect event logs or syslog.
Option C uses the legacy Log Analytics agent, which was retired on 31 August 2024, and the requirement rules it out.
Option D is not available for guest logs. A diagnostic setting on an Azure resource exports its platform logs and metrics, and a VM's operating system logs are collected by the agent, not by diagnostic settings on the VM resource.
Reference: Azure Monitor Agent overview