You have an on-prem server Server1 (Windows Server 2025 Standard) and several Azure virtual machines. A Microsoft Sentinel instance (Sentinel1) exists in the Central US region. When implementing Windows Firewall Events using the AMA connector, which servers can send Windows Firewall events to Sentinel1?
Choose an answer
Tap an option to check your answer.
Correct answer: VM1, VM2, and VM3 only.
Why this is the answer
The AMA (Azure Monitor Agent) connector for Windows Firewall Events in Microsoft Sentinel is designed to collect logs from Azure Arc-enabled servers and Azure virtual machines. Server1 is an on-premises server running Windows Server 2025 Standard. For an on-premises server to send logs to Azure Monitor (and thus Sentinel) via the AMA, it must be Azure Arc-enabled. The question does not state that Server1 is Azure Arc-enabled, therefore it cannot send logs using the AMA connector in this scenario. VM1, VM2, and VM3 are Azure virtual machines, which inherently support the Azure Monitor Agent and can send their Windows Firewall events to Sentinel1.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed