Securing Windows Server 2016 — Question 185

You configure a server named Server1 to report to a Microsoft Azure Log Analytics workspace named Workspace1.
Several events are added to the System log on Server1.
You run queries in Workspace1, and no events are returned from Server1.
You confirm that Server1 reports to Workspace1.
You need to ensure that events from Server1 are sent to Workspace1.
What should you do?

Answer options

• A. In Workspace1, configure the Advanced settings
• B. On Server1, configure the Microsoft Monitoring Agent settings
• C. On Server1, configure an event subscription
• D. From Azure Monitor, add a management solution

Correct answer: B

Explanation

The correct answer is B because the Microsoft Monitoring Agent settings on Server1 must be correctly configured to send logs to Workspace1. Options A, C, and D do not directly address the need for the agent on Server1 to report the logs, which is necessary for the events to be sent successfully.