Question
A customer has a hybrid cloud infrastructure that contains a Microsoft 365 E5 subscription and an Azure subscription.
All on-premises servers in the perimeter network are prevented from connecting directly to the internet.
The customer recently recovered from a ransomware attack.
The customer plans to deploy Microsoft Sentinel.
You need to recommend solutions to meet the following requirements:
✑ Ensure that the security operations team can access the security logs and the operation logs.
✑ Ensure that the IT operations team can access only the operations logs, including the event logs of the servers in the perimeter network.
Which two solutions should you include in the recommendation? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
- A. a custom collector that uses the Log Analytics agent
- B. the Azure Monitor agent Correct
- C. resource-based role-based access control (RBAC) Correct
- D. Azure Active Directory (Azure AD) Conditional Access policies
Explanation
The Azure Monitor agent (B) collects the event logs from the on-premises servers, including those in the perimeter network, which can send their data through the Log Analytics gateway or a proxy because they cannot reach the internet directly. Data collection rules control which data goes to which workspace. Resource-context role-based access control (RBAC) (C) lets the security operations team read all security and operations logs in the workspace, while the IT operations team gets access only to the operations data for the resources they manage. The Log Analytics agent is retired, and Conditional Access controls sign-in, not access to log data.
