AZ-802 Practice Question: Monitor and Troubleshoot Windows Server Environments
You are configuring Windows Event Forwarding (WEF) in a domain environment. You want the collector server to initiate the connection to the source computers to gather events. Which type of subscription should you implement to achieve this behavior?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Collector-initiated subscription
Windows Event Forwarding supports two main subscription models: source-initiated and collector-initiated. Choosing the correct model depends on network topology and management requirements. Collector-initiated subscriptions are useful when the administrator wants the central server to control the polling interval and manage the list of source computers explicitly within the subscription configuration itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Source-initiated subscription
Why it's wrong here
In this model, the source computers are configured via Group Policy to push their events to the collector. This is more scalable for large environments and works better through firewalls, as the source computer initiates the outbound connection. It does not meet the requirement of the collector initiating the connection.
- ✓
Collector-initiated subscription
Why this is correct
This model requires the collector server to have a list of all source computers. The collector then connects to each source computer using WinRM to pull the events. This satisfies the requirement where the central server is the initiator of the communication channel for event log harvesting.
- ✗
WMI-based subscription
Why it's wrong here
WMI can be used for various monitoring tasks, but it is not a standard subscription 'type' for Windows Event Forwarding. WEF specifically utilizes the WS-Management protocol (WinRM) for transporting event data between servers, making WMI an incorrect classification for the architectural design of an event forwarding system.
- ✗
Push-based subscription
Why it's wrong here
While 'push' describes the direction of data flow in a source-initiated setup, it is not the formal technical term used in Windows Server documentation for subscription types. Using non-standard terminology can lead to confusion when configuring the Windows Event Collector service and associated Group Policy Objects.
About these practice questions
Courseiva writes every AZ-802 question from scratch — 116 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.