Your company has a custom security application that writes logs in JSON format to a local file on a Linux server. You need to ingest these logs into Microsoft Sentinel and query them efficiently. The logs have a unique schema that does not match any built-in table. What should you do?

Use the Syslog via AMA connector and configure the application to log to Syslog.

Create a diagnostic setting on the Linux server to send the file to Sentinel.

Use the Log Analytics agent's custom log feature to collect the file and store it in the default table.

Use the Custom Logs via AMA connector to collect the JSON file and create a new custom table in the workspace.

Your organization subscribes to a threat intelligence feed that provides indicators via a TAXII 2.0 server. You need to ingest these indicators into Microsoft Sentinel and ensure they are available for analytics rules. What should you do?

Create a custom log table and use a Logic App to pull indicators from the TAXII server and store them in the custom table.

Use the Microsoft Defender Threat Intelligence data connector to ingest the feed.

Upload the indicators manually using the Threat Intelligence - Upload Indicators connector.

Use the Threat Intelligence - TAXII data connector, configure the API root URL and collection ID, and enable it.

Your company has a hybrid environment with Windows servers on-premises and in Azure. You need to collect Windows Security events (e.g., 4624, 4625) from all servers into Microsoft Sentinel. You want to use a single method for both environments. What should you do?

Use the Log Analytics agent for on-premises servers and AMA for Azure VMs.

Use Windows Event Forwarding (WEF) to forward events from all servers to a central collector, then install AMA on the collector.

Create two separate data collection rules: one for on-premises and one for Azure.

Install AMA on all servers and create a data collection rule that targets both on-premises and Azure servers, selecting the Windows Security Events data source.

What is the primary purpose of ingesting threat intelligence indicators into Microsoft Sentinel?

To store indicators for compliance purposes.

To automatically block malicious IPs in Azure Firewall.

To enhance detection by correlating indicators with events and alerts.

To replace the need for analytics rules.

In Microsoft Sentinel, what is the process for creating a custom log table to store data from a custom source?

Create a custom connector in Sentinel to define the table.

Create a table in the Log Analytics workspace using the API or UI, then ingest data into that table.

Use the Azure Portal to create a table in the Sentinel workspace directly.

Use Azure Policy to define a new table.

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 3

Ingest Data into the Microsoft Sentinel SIEM and Platform SC-200 Practice Questions (Page 5)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

7concepts

40–45%of the exam

Questions 21–25

21application · medium
Your company has a custom security application that writes logs in JSON format to a local file on a Linux server. You need to ingest these logs into Microsoft Sentinel and query them efficiently. The logs have a unique schema that does not match any built-in table. What should you do?
Select an answer first
22application · medium
Your organization subscribes to a threat intelligence feed that provides indicators via a TAXII 2.0 server. You need to ingest these indicators into Microsoft Sentinel and ensure they are available for analytics rules. What should you do?
Select an answer first
23application · medium
Your company has a hybrid environment with Windows servers on-premises and in Azure. You need to collect Windows Security events (e.g., 4624, 4625) from all servers into Microsoft Sentinel. You want to use a single method for both environments. What should you do?
Select an answer first
24foundation · easy
What is the primary purpose of ingesting threat intelligence indicators into Microsoft Sentinel?
Select an answer first
25foundation · easy
In Microsoft Sentinel, what is the process for creating a custom log table to store data from a custom source?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.