AZ-500 Manage identity and access Practice Question
An organization is deploying Microsoft Sentinel to centrally collect and analyze security events. They need to ingest logs from multiple on-premises Windows servers located behind a firewall. Which agent should they deploy on those servers?
⚠ Common exam trap
Test-takers frequently confuse the legacy Log Analytics agent (option B) as still being the primary agent for Sentinel, but Microsoft has deprecated it in favor of AMA, and the exam expects knowledge of the current recommended agent.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Monitor Agent (AMA)
The Azure Monitor Agent (AMA) is the correct choice because it is the current, unified data-collection agent for Microsoft Sentinel and Azure Monitor, designed to collect logs from Windows servers behind firewalls via outbound HTTPS (port 443) to the Log Analytics workspace. It supports data-collection rules (DCRs) for flexible, scalable ingestion and is the recommended replacement for the legacy Log Analytics agent. AMA can be deployed on-premises Windows servers using Azure Arc for management, ensuring secure log forwarding to Sentinel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Monitor Agent (AMA)
Why this is correct
Azure Monitor Agent (AMA) is the current, consolidated data-collection platform that unifies the functionality of the Log Analytics agent and the Diagnostics extension. It uses Data Collection Rules (DCRs) to define exactly which logs and metrics to collect from Windows and Linux machines, including security events, Syslog, and custom logs. Microsoft Sentinel fully supports AMA, and it is the recommended agent for all new deployments, providing better performance, manageability, and feature parity across Azure and non-Azure resources.
- ✗
Log Analytics agent (Microsoft Monitoring Agent)
Why it's wrong here
The Log Analytics agent, also known as the Microsoft Monitoring Agent (MMA), was the legacy agent used for collecting logs to Log Analytics workspaces and Sentinel. While it still works for security-event collection, Microsoft has announced deprecation and is transitioning all customers to Azure Monitor Agent. It does not support newer features like DCR-based filtering, and its performance and management capabilities are inferior, making it unsuitable as the recommended choice for a new Sentinel deployment.
- ✗
Azure Security Center agent
Why it's wrong here
There is no standalone agent called the 'Azure Security Center agent.' Security data in Microsoft Defender for Cloud (formerly Azure Security Center) is collected via the same agents used by Log Analytics—historically the Log Analytics agent or now the Azure Monitor Agent—depending on the workspace configuration. Referring to a separate 'Azure Security Center agent' reflects a misunderstanding; the agent that collects security logs is the monitoring agent that feeds both Defender for Cloud and Sentinel.
- ✗
Azure Automation Agent
Why it's wrong here
The Azure Automation Agent is actually the Hybrid Runbook Worker, which is designed to execute runbooks and automation jobs on on-premises or cloud machines, not to collect security logs. It does not send security events, Syslog, or Windows event logs to Log Analytics/Sentinel. While Automation can interact with Sentinel APIs for orchestration, the Hybrid Runbook Worker role is not a data-collection agent and cannot serve as the primary source for centralized analysis.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.