Microsoft - AZ-801: Configuring Windows Server Hybrid Advanced Services

Sample Questions

Explanation:

After you onboard Microsoft Sentinel into your workspace, use data connectors to start ingesting your data into Microsoft Sentinel. Microsoft Sentinel comes with many out of the box connectors for Microsoft services, which integrate in real time.

To add more data connectors, install the solution associated with the data connector from the Content Hub.

From Content hub, we need to install the Windows Firewall solution. Installing this solution will deploy two data connectors:

1. Windows Firewall Events via AMA - This data connector helps in ingesting Windows Firewall Events into your Log Analytics Workspace using the new Azure Monitor Agent. 
2. Windows Firewall - This solution installs the data connector to ingest Windows Firewall events using the Windows Firewall solution for Azure. 

From Data Connectors, we need to integrate the Windows Firewall Events via AMA connector and configure a data collection rule that enables the collection of one or more firewall profiles from Server1.

References:

Microsoft Sentinel data connectors

Windows Firewall

• Ensure that all AD DS authentication events are captured.
• Prevent the use of port mirroring.

Explanation:

Microsoft Defender for Identity uses Directory Service Accounts (DSAs). For example, when you have a DSA configured, the DSA is used to connect to the domain controller at startup. A DSA can also be used to query the domain controller for data on entities seen in network traffic, monitored events, and monitored ETW activities

Defender for Identity uses sensors to collect signals from your on-premises identity infrastructure to detect threats. There are two types of sensors.

Microsoft Defender for Identity sensor 
This is the recommended sensor type. The Defender for Identity sensor must be installed on each domain controller including read-only domain controllers (RODCs), each Active Directory Federation Services (AD FS) server, each Active Directory Certificate Services (AD CS) server, and on each Entra Connect server.

Use the table below to select the recommended sensor version.

Microsoft Defender for Identity standalone sensor 
Standalone sensors can be installed on servers that are in a workgroup and are capable of monitoring multiple domain controllers. The usage of standalone sensors requires the use of port mirroring.

References:

Directory Service Accounts for Microsoft Defender for Identity

Microsoft Defender for Identity deployment overview

• Ensure that you can monitor the memory usage on VM1.
• Ensure that you run the Map feature on VM2.

Explanation:

The Azure Monitor Agent collects monitoring data from the guest operating system of Azure and hybrid virtual machines (VMs). It delivers the data to Azure Monitor for use by features, insights, and other services, such as Microsoft Sentinel and Microsoft Defender for Cloud.

The Azure Monitor Agent can be installed on Windows and Linux virtual machines.

The Azure Monitor Agent for Windows supports the following data sources:

• Event Logs
• Performance
• File-based logs
• Internet Information Services (IIS) logs

The Azure Monitor Agent for Linux supports the following data sources:

• Syslog
• Performance
• File-based logs

The Azure Monitor for VMs Map feature gets its data from the Microsoft Dependency agent. The Azure VM Dependency agent virtual machine extension for Linux installs the Dependency agent on Azure virtual machines. 

References:

Azure Monitor Agent overview

Install and manage the Azure Monitor Agent

Azure Monitor Dependency virtual machine extension for Linux

• The minimum password length must be 12 characters.
• Passwords must expire in 90 days.
• Passwords must be complex.

• The minimum password length must be 16 characters.
• Passwords must expire in 60 days.
• Passwords must be complex.

Explanation:

The Password Policy settings configured in the Default Domain Policy apply to all domain users. We need to ensure that these settings are configured to meet the domain password requirements.

To configure deviant password requirements for the members of the security team, we can configure an assign a fine-grained password policy which is also refered to as password settings object (PSO).

Fine Grained Password policies provide you with a way to define different password and account lockout policies for different sets of users in a domain. You can use fine grained password policies to specify multiple password policies within a single domain. You can also apply different restrictions for password and account lockout policies to different sets of users in a domain. For example, you can apply stricter settings to privileged accounts and less strict settings to the accounts of other users.

Fine-grained password policies apply only to global security groups and user objects. By default, only members of the Domain Admins group can set fine grained password policies. However, you can also delegate the ability to set these policies to other users.

 To create a fine grained password policy, you use the Active Directory Administrative Center (dsac.exe).

Reference: Configure fine grained password policies for Active Directory Domain Services

Explanation:

To discover all Hyper-V hosts and virtual machines in your on-premises environment using Azure Migrate, you first need to deploy the Azure Migrate: Discovery and assessment tool, a lightweight Azure Migrate appliance.

You deploy the appliance as a server on a Hyper-V host, to continuously discover servers and their performance metadata, applications that are running on servers, server dependencies, web apps, and SQL Server instances and databases.

References:

Discovery methods in Azure Migrate

Tutorial: Discover servers running on Hyper-V with Azure Migrate: Discovery and assessment