Your organization has 2,000 legacy Windows Server 2012 R2 servers that cannot have the Azure Monitor Agent (AMA) installed directly. You need to collect Windows Security events from these servers into Microsoft Sentinel. You have a limited number of Windows Server 2022 collector servers available. What should you configure?

Configure Windows Event Forwarding (WEF) on the source servers to forward Security events to the collector servers, then install AMA on the collectors and create a DCR to collect the forwarded events.

Install the Log Analytics agent on the source servers and configure the Windows Event Log data source in the workspace.

Use Azure Arc to onboard the servers and then install AMA via Azure Policy.

Create a DCR that targets the source servers directly using AMA, even though they are unsupported.

Your organization uses a custom security application that writes JSON logs to a Linux server. You need to ingest these logs into Microsoft Sentinel for analysis. The logs do not match any built-in connector. What should you do?

Use the Syslog connector to collect the JSON logs as syslog messages.

Use the Log Analytics HTTP Data Collector API to send the JSON logs directly from the application.

Create a custom table and use the 'Custom Logs' data connector in the Sentinel UI.

Create a custom log table in Sentinel, then configure AMA on the Linux server with a DCR that collects the JSON file and uses a transformation to parse it into the custom table.

Your environment has 2,000 non-domain-joined Windows servers that must send Security events to Microsoft Sentinel. You have limited bandwidth and want to minimize the number of internet-facing endpoints. You decide to use Windows Event Forwarding (WEF). Which collector configuration should you use?

Configure each source machine to forward events to a central Syslog server, then use the Syslog via AMA connector to ingest them.

Install the AMA on each source machine and configure a DCR to send events directly to Sentinel, bypassing WEF.

Use the legacy Log Analytics agent on each source machine and configure Windows Event Log collection in the workspace.

Configure a single Windows server as a WEF collector and forward events to it from all source machines, then install the AMA on the collector and use a DCR to send the events to Sentinel.

Your network devices (routers, switches, firewalls) send logs in syslog format. You need to ingest these logs into Microsoft Sentinel. Some devices support CEF, others only raw syslog. You have a Linux server available. What should you do?

Use two separate Linux servers: one for syslog and one for CEF.

Use the legacy Log Analytics agent for syslog and AMA for CEF.

Install AMA on the Linux server, configure the devices to send syslog to the server, and create a DCR with both 'Syslog' and 'Common Event Format' data sources.

Create a custom log table and use the HTTP Data Collector API to send syslog and CEF logs directly from the devices.

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 3

Ingest Data into the Microsoft Sentinel SIEM and Platform SC-200 Practice Questions (Page 4)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

7concepts

40–45%of the exam

Questions 16–20

16foundation · easy
When configuring the Windows Security Events via AMA connector in Microsoft Sentinel, what must be created to define which event IDs and log levels to collect?
Select an answer first
17application · medium
Your organization has 2,000 legacy Windows Server 2012 R2 servers that cannot have the Azure Monitor Agent (AMA) installed directly. You need to collect Windows Security events from these servers into Microsoft Sentinel. You have a limited number of Windows Server 2022 collector servers available. What should you configure?
Select an answer first
18application · medium
Your organization uses a custom security application that writes JSON logs to a Linux server. You need to ingest these logs into Microsoft Sentinel for analysis. The logs do not match any built-in connector. What should you do?
Select an answer first
19application · medium
Your environment has 2,000 non-domain-joined Windows servers that must send Security events to Microsoft Sentinel. You have limited bandwidth and want to minimize the number of internet-facing endpoints. You decide to use Windows Event Forwarding (WEF). Which collector configuration should you use?
Select an answer first
20application · medium
Your network devices (routers, switches, firewalls) send logs in syslog format. You need to ingest these logs into Microsoft Sentinel. Some devices support CEF, others only raw syslog. You have a Linux server available. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Ingest Data into the Microsoft Sentinel SIEM and Platform SC-200 Practice Questions (Page 4)

Questions 16–20

When configuring the Windows Security Events via AMA connector in Microsoft Sentinel, what must be created to define which event IDs and log levels to collect?

Your organization uses a custom security application that writes JSON logs to a Linux server. You need to ingest these logs into Microsoft Sentinel for analysis. The logs do not match any built-in connector. What should you do?

Your environment has 2,000 non-domain-joined Windows servers that must send Security events to Microsoft Sentinel. You have limited bandwidth and want to minimize the number of internet-facing endpoints. You decide to use Windows Event Forwarding (WEF). Which collector configuration should you use?

Your network devices (routers, switches, firewalls) send logs in syslog format. You need to ingest these logs into Microsoft Sentinel. Some devices support CEF, others only raw syslog. You have a Linux server available. What should you do?

Keep studying — Manage a security operations environment