Your organization has an Azure subscription with many resources. You need to collect Azure activity logs for all resources into Microsoft Sentinel. You want to use Azure Policy to ensure that new resources automatically get diagnostic settings configured. What should you do?

Use Azure Policy to deploy a diagnostic setting that sends the Activity Log to the Sentinel workspace, and assign the policy to the subscription.

Enable the Azure Activity connector in Sentinel and rely on it to automatically collect all activity logs.

Create a diagnostic setting for each resource manually and export to the Sentinel workspace.

Create a custom log table and use a Logic App to periodically pull activity logs into Sentinel.

What is the primary difference between the Syslog via AMA and CEF via AMA connectors in Microsoft Sentinel?

Syslog uses UDP only, while CEF uses TCP only.

Syslog is used for network devices, while CEF is used for cloud services.

CEF is a standardized format with built-in parsing, while Syslog is a general log format that may require custom parsing.

CEF is used for Windows logs, while Syslog is used for Linux logs.

Your organization has a security operations center (SOC) that needs to ingest logs from Windows servers, Linux servers, and network devices. You have a limited budget and want to minimize the number of agents and connectors. You also need to ensure that all logs are available in Sentinel for analysis. What should you do?

Use the legacy Log Analytics agent for all sources.

Use a custom log table and the HTTP Data Collector API for all sources.

Use Windows Event Forwarding for Windows servers, AMA for Linux servers, and a separate syslog connector for network devices.

Install AMA on Windows and Linux servers, and use a Linux server with AMA to collect syslog from network devices. Use a single DCR to define all data sources.

Your security team uses a third-party firewall that sends logs in Common Event Format (CEF) over syslog. You need to ingest these logs into Microsoft Sentinel. The firewall does not support AMA installation. You have a Linux server that can act as a log forwarder. What should you configure?

Create a custom log table and use the Log Analytics HTTP Data Collector API to send CEF logs directly from the firewall.

Configure the firewall to send logs directly to the Sentinel workspace ID and key.

Install the Azure Monitor Agent on the Linux server, configure the firewall to send CEF logs to the Linux server, and create a data collection rule with the 'Common Event Format' data source.

Use the legacy Log Analytics agent on the Linux server and configure the CEF connector in the Sentinel UI.

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 3

Ingest Data into the Microsoft Sentinel SIEM and Platform SC-200 Practice Questions (Page 2)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

7concepts

40–45%of the exam

Questions 6–10

6application · medium
Your organization has an Azure subscription with many resources. You need to collect Azure activity logs for all resources into Microsoft Sentinel. You want to use Azure Policy to ensure that new resources automatically get diagnostic settings configured. What should you do?
Select an answer first
7foundation · easy
Which Microsoft Sentinel data connector is used to ingest threat intelligence indicators from external sources such as TAXII feeds?
Select an answer first
8foundation · easy
What is the primary difference between the Syslog via AMA and CEF via AMA connectors in Microsoft Sentinel?
Select an answer first
9expert · hard
Your organization has a security operations center (SOC) that needs to ingest logs from Windows servers, Linux servers, and network devices. You have a limited budget and want to minimize the number of agents and connectors. You also need to ensure that all logs are available in Sentinel for analysis. What should you do?
Select an answer first
10application · medium
Your security team uses a third-party firewall that sends logs in Common Event Format (CEF) over syslog. You need to ingest these logs into Microsoft Sentinel. The firewall does not support AMA installation. You have a Linux server that can act as a log forwarder. What should you configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Ingest Data into the Microsoft Sentinel SIEM and Platform SC-200 Practice Questions (Page 2)

Questions 6–10

Your organization has an Azure subscription with many resources. You need to collect Azure activity logs for all resources into Microsoft Sentinel. You want to use Azure Policy to ensure that new resources automatically get diagnostic settings configured. What should you do?

Which Microsoft Sentinel data connector is used to ingest threat intelligence indicators from external sources such as TAXII feeds?

What is the primary difference between the Syslog via AMA and CEF via AMA connectors in Microsoft Sentinel?

Your security team uses a third-party firewall that sends logs in Common Event Format (CEF) over syslog. You need to ingest these logs into Microsoft Sentinel. The firewall does not support AMA installation. You have a Linux server that can act as a log forwarder. What should you configure?

Keep studying — Manage a security operations environment