AZ-500 Manage identity and access Practice Question
A security engineer needs to collect custom application logs from Azure VMs using Azure Monitor Agent for Sentinel analysis. Which two components are required?
⚠ Common exam trap
A common mix-up: candidates confuse storage accounts (used for Azure Diagnostics extension or legacy agents) with the modern Azure Monitor Agent requirement, or mistakenly think Conditional Access policies are relevant to log ingestion.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Data Collection Rule that defines the custom log collection
Option A is correct because a Data Collection Rule (DCR) is the Azure Monitor Agent mechanism that defines what data to collect, including custom logs via a custom text or JSON log definition, and where to send it (e.g., a Log Analytics workspace used by Microsoft Sentinel). Option C is correct because a DCR must be associated with the target machines (through a DCR association on the VM or via Azure Policy/monitoring insights) for the Azure Monitor Agent to actually apply that collection configuration to those VMs. Option B is incorrect because a storage account configured for static website hosting is unrelated to log ingestion by Azure Monitor Agent; custom logs are sent to a Log Analytics workspace, not served as web content. Option D is incorrect because Conditional Access policies govern user/identity sign-in access to resources and play no role in agent-based log collection from VMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A Data Collection Rule that defines the custom log collection
Why this is correct
A Data Collection Rule defines which custom logs Azure Monitor Agent gathers, including the destination workspace and parsing logic. Without a DCR, the agent has no collection specification, making it an essential component for Sentinel ingestion.
- ✗
A storage account configured for static website hosting
Why it's wrong here
Static website hosting serves HTML content from blob storage; it provides no ingestion endpoint for Azure Monitor Agent. A storage account is required in this scenario only as the destination for collected logs, not configured for website hosting.
- ✓
Association of the Data Collection Rule with the target machines
Why this is correct
Associating the Data Collection Rule with target machines binds the collection definition to specific VMs, instructing Azure Monitor Agent which hosts to monitor. A DCR alone collects nothing until associated, so this association is the second required component.
- ✗
A Conditional Access policy requiring MFA
Why it's wrong here
Conditional Access governs interactive user sign-ins to cloud applications; it plays no part in agent-based log ingestion. It would be the correct control when the requirement is enforcing MFA or device compliance for users accessing Microsoft Entra ID-integrated apps.
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.