Can Arc Agent and AMA Extension Enable Windows Firewall Log Collection in Sentinel?

AZ-801 By islever Editorial Last updated

Short answer

A Yes

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an on-premises server named Server1 that runs Windows Server. You have a Microsoft Sentinel instance. You add the Windows Firewall data connector in Microsoft Sentinel. You need to ensure that Microsoft Sentinel can collect Windows Firewall logs from Server1. Solution: You install the Azure Connected Machine agent and Azure Monitor Agent for Windows extension on Server1. Does this meet the goal?
  1. Yes Correct Answer
  2. No

Key Takeaways

The exam tests whether you know that Azure Arc's Connected Machine agent is the prerequisite for deploying the Azure Monitor Agent extension on on-premises servers, which the Windows Firewall data connector uses to stream logs to Sentinel.

To collect Windows Firewall logs from an on-premises Windows Server into Microsoft Sentinel, you must first Azure Arc-enable the server and then install the Azure Monitor Agent extension. The community and official guidance confirm this solution meets the goal, making the correct answer Yes.

Common mistake: Selecting B because you think the Azure Monitor Agent extension cannot be installed on on-premises machines; in reality, the Azure Connected Machine agent enables extension management on Arc-enabled servers, so the extension works exactly as intended.

Expert Analysis

Why the Answer Is Correct

The proposed solution involves installing the Azure Connected Machine agent, which onboards Server1 into Azure Arc. Once Server1 is Arc-enabled, you can install the Azure Monitor Agent for Windows extension as a virtual machine extension. Microsoft Sentinel's Windows Firewall data connector leverages Azure Monitor Agent to collect firewall logs from machines that have this agent deployed, regardless of whether they are Azure VMs or on-premises servers. Therefore, the solution fully satisfies the goal of enabling Sentinel to collect Windows Firewall logs from Server1.

Why the Other Options Are Wrong

The only alternative was 'No', but there is no technical reason the solution would fail. If Server1 already has Windows Firewall logging enabled and the connector's data collection rule is configured, the combination of Arc and the AMA extension works correctly. One community comment (Comment [3]) incorrectly claimed that the AMA extension does not work on on-premises machines, but that comment overlooks the fact that the Azure Connected Machine agent gives the server the local ability to host VM extensions, including the Azure Monitor Agent extension.

Community Comment Notes

Comment [1] correctly supports answer 'Yes' by noting that the logs can be collected assuming logging is enabled and the connector's data collection rule picks up the events. Comment [2] adds a practical note that you can tune collection, but there may be costs. Comment [3], the only 'B' vote, misunderstands the architecture; the standalone AMA is unnecessary because the Arc infrastructure allows the standard AMA extension to run on on-premises servers. The majority vote (83%) for 'Yes' aligns with the official answer.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Remember that for on-premises Windows servers, Sentinel data connectors that use Azure Monitor Agent require Azure Arc first. On exam day, if you see a solution that installs the Connected Machine agent and then the AMA extension, treat it as a valid way to enable log collection; just verify that the relevant connector and data collection rule are also configured.

Community Votes

A
83%
B
17%

83% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Krayzr 👍 2 Answered A
    The proposed solution—installing the Azure Connected Machine Agent and the Azure Monitor Agent for Windows extension on Server1—meets the goal of ensuring Microsoft Sentinel can collect Windows Firewall logs, assuming logging is enabled on Server1 and the connector’s DCR configures the agent appropriately. Thus, the answer is: A. Yes
  2. ducklaorange 👍 2 Answered A
    Yep, you can tune it to collect what you want...at a price.
  3. indope94 👍 1 Answered B
    Nee (B) – de oplossing haalt het doel niet omdat de AMA extensie niet werkt op on-prem machines. Je moet daar de standalone AMA gebruiken ná Arc-enablement
  4. sardonique 👍 1 Answered A
    this looks like a right answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to On-Prem VMs Forward Events to Azure Sentinel?

S-grade

What should you do first to implement JIT VM access for VM1?

S-grade

Which Groups Grant Least Privilege to Add a Windows Server 2022 DC?

S-grade

Where Can You Enable Microsoft Defender for Servers in Azure?

S-grade

← Back to AZ-801 Study Guide