The answer is to deploy the Azure Monitor agent via Azure Policy and create a data collection rule to collect Event ID 4625. This is correct because the Azure Monitor agent (AMA) is the modern, scalable replacement for the legacy Log Analytics agent, and when combined with Azure Policy, it enforces consistent deployment across all 500 VMs without manual intervention. A data collection rule (DCR) then filters security events at the source, collecting only the specific Event ID 4625 for failed logons, which eliminates high-volume noise events before they are ingested into the Log Analytics workspace, directly reducing costs. On the AZ-305 exam, this scenario tests your understanding of centralized monitoring architecture and the shift from agent-based to rule-based collection; a common trap is choosing the legacy agent or using a diagnostic setting, which does not filter events at the source. Memory tip: think “Policy for deployment, DCR for filtering” — the DCR is your cost-control lever by defining exactly which event IDs to collect.
AZ-305 Practice Question: Design identity, governance, and monitoring solutions
This AZ-305 practice question tests your understanding of design identity, governance, and monitoring solutions. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your organization uses Azure Monitor to monitor a fleet of 500 VMs running Windows Server. You need to collect security event logs (Event ID 4625 for failed logons) from all VMs and send them to a Log Analytics workspace. The solution must support centralized configuration and be scalable. You also want to filter out high-volume noise events to reduce costs. What should you do?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy the Azure Monitor agent via Azure Policy and create a data collection rule to collect Event ID 4625.
Option D is correct because the Azure Monitor agent (AMA) is the current recommended agent for collecting security events from VMs, and using Azure Policy to deploy it ensures centralized, scalable configuration across 500 VMs. A data collection rule (DCR) can be configured to collect only Event ID 4625, filtering out high-volume noise events at the source, which reduces costs by minimizing data ingestion into the Log Analytics workspace.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Enable VM Insights on all VMs and use the Performance view to detect failed logons.
Stream events to Azure Event Hubs and use a function to filter and send to Log Analytics.
Why it's wrong here
This is more complex and costly than using Azure Monitor agent.
✗
Install the Log Analytics agent on each VM and configure Windows Event log collection in the workspace.
Why it's wrong here
Log Analytics agent is deprecated and lacks centralized filtering at the agent level.
✓
Deploy the Azure Monitor agent via Azure Policy and create a data collection rule to collect Event ID 4625.
Why this is correct
Azure Monitor agent with DCRs provides scalable, centralized configuration and filtering.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may choose the Log Analytics agent (MMA) option because it is familiar from legacy setups, but the exam tests knowledge of the newer Azure Monitor agent (AMA) and its centralized configuration via DCRs, which is the recommended and scalable solution for modern environments.
Detailed technical explanation
How to think about this question
The Azure Monitor agent uses data collection rules (DCRs) to define which events to collect, including XPath queries for specific Event IDs, which allows filtering at the agent level before data is sent to the workspace, reducing ingestion costs. Azure Policy can be used to enforce AMA deployment and DCR association across all VMs at scale, ensuring compliance without manual intervention. The AMA also supports multiple destinations and is built on a common agent framework (AMA/Microsoft Monitoring Agent replacement) that integrates with Azure Monitor and Microsoft Sentinel.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A startup's cloud architect reviews their monthly bill and notices costs are higher than expected for a long-running batch job. Switching from on-demand instances to Reserved Instances — or using Spot/Preemptible VMs — can reduce compute costs by up to 72 %. Questions like this test whether you understand the tradeoffs between commitment, flexibility, and cost across cloud pricing models.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-305 question in full detail.
Design identity, governance, and monitoring solutions — This question tests Design identity, governance, and monitoring solutions — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Deploy the Azure Monitor agent via Azure Policy and create a data collection rule to collect Event ID 4625. — Option D is correct because the Azure Monitor agent (AMA) is the current recommended agent for collecting security events from VMs, and using Azure Policy to deploy it ensures centralized, scalable configuration across 500 VMs. A data collection rule (DCR) can be configured to collect only Event ID 4625, filtering out high-volume noise events at the source, which reduces costs by minimizing data ingestion into the Log Analytics workspace.
What should I do if I get this AZ-305 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are required to collect Windows security events into Microsoft Sentinel?
hard
✓ A.Log Analytics workspace
✓ B.Data collection rule (DCR)
C.Azure Policy
✓ D.Azure Monitor Agent (AMA)
E.Microsoft Defender for Cloud
Why A: A Log Analytics workspace is required because Microsoft Sentinel is built on top of it; all security events collected by Sentinel are stored in the workspace's tables, and Sentinel uses the workspace as its data repository for analytics, alerting, and investigation.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.