Can Arc Agent and AMA Extension Enable Windows Firewall Log Collection in Sentinel?
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an on-premises server named Server1 that runs Windows Server. You have a Microsoft Sentinel instance. You add the Windows Firewall data connector in Microsoft Sentinel. You need to ensure that Microsoft Sentinel can collect Windows Firewall logs from Server1. Solution: You install the Azure Connected Machine agent and Azure Monitor Agent for Windows extension on Server1. Does this meet the goal?
Community Votes
83% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you know that Azure Arc's Connected Machine agent is the prerequisite for deploying the Azure Monitor Agent extension on on-premises servers, which the Windows Firewall data connector uses to stream logs to Sentinel.
To collect Windows Firewall logs from an on-premises Windows Server into Microsoft Sentinel, you must first Azure Arc-enable the server and then install the Azure Monitor Agent extension. The community and official guidance confirm this solution meets the goal, making the correct answer Yes.
Selecting B because you think the Azure Monitor Agent extension cannot be installed on on-premises machines; in reality, the Azure Connected Machine agent enables extension management on Arc-enabled servers, so the extension works exactly as intended.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The proposed solution involves installing the Azure Connected Machine agent, which onboards Server1 into Azure Arc. Once Server1 is Arc-enabled, you can install the Azure Monitor Agent for Windows extension as a virtual machine extension. Microsoft Sentinel's Windows Firewall data connector leverages Azure Monitor Agent to collect firewall logs from machines that have this agent deployed, regardless of whether they are Azure VMs or on-premises servers. Therefore, the solution fully satisfies the goal of enabling Sentinel to collect Windows Firewall logs from Server1.
Why the Other Options Are Wrong
The only alternative was 'No', but there is no technical reason the solution would fail. If Server1 already has Windows Firewall logging enabled and the connector's data collection rule is configured, the combination of Arc and the AMA extension works correctly. One community comment (Comment [3]) incorrectly claimed that the AMA extension does not work on on-premises machines, but that comment overlooks the fact that the Azure Connected Machine agent gives the server the local ability to host VM extensions, including the Azure Monitor Agent extension.
Community Comment Notes
Comment [1] correctly supports answer 'Yes' by noting that the logs can be collected assuming logging is enabled and the connector's data collection rule picks up the events. Comment [2] adds a practical note that you can tune collection, but there may be costs. Comment [3], the only 'B' vote, misunderstands the architecture; the standalone AMA is unnecessary because the Arc infrastructure allows the standard AMA extension to run on on-premises servers. The majority vote (83%) for 'Yes' aligns with the official answer.
Official Reference
Exam Strategy
Remember that for on-premises Windows servers, Sentinel data connectors that use Azure Monitor Agent require Azure Arc first. On exam day, if you see a solution that installs the Connected Machine agent and then the AMA extension, treat it as a valid way to enable log collection; just verify that the relevant connector and data collection rule are also configured.