Your security team needs to ingest logs from multiple sources: Windows Security events, Linux syslog, and Azure Activity logs. You want to use the most appropriate connectors for each source. What should you do?

Use a single custom log table and ingest all logs via the HTTP Data Collector API.

Use Windows Event Forwarding for Windows events, AMA for syslog, and Azure Policy for activity logs.

Use the legacy Log Analytics agent for Windows and syslog, and the Azure Activity connector for activity logs.

Use AMA-based connectors for Windows Security events and syslog, and the Azure Activity connector for activity logs.

Your organization has a security appliance that sends logs in CEF format. You have a Linux server that runs AMA and is already collecting syslog from other devices. You need to ingest the CEF logs into Sentinel. The appliance does not support sending to a different port. What should you do?

Create a custom log table and use a transformation to parse CEF logs from the syslog stream.

Use a separate Linux server for CEF to avoid conflicts with syslog.

Use the legacy Log Analytics agent for CEF and AMA for syslog.

Configure the CEF data source in the same DCR that collects syslog, and set the appliance to send logs to the same syslog port on the Linux server.

Your organization has a new Azure subscription with 50 virtual machines. You need to collect Azure activity logs (e.g., VM create, delete, and security policy changes) into Microsoft Sentinel. You want to use Azure Policy to ensure that all current and future VMs have diagnostic settings enabled. What should you do?

Create a diagnostic setting for the subscription to stream the Activity log to the Sentinel workspace.

Use the 'Azure Policy' data connector to ingest activity logs directly.

Enable the 'Azure Activity' data connector in Sentinel and manually configure diagnostic settings for each VM.

Create an Azure Policy initiative that deploys diagnostic settings for the Activity log to the Sentinel workspace and assign it at the subscription level.

Your company has 500 Windows servers that must send Security events (4624, 4625, 4720) to Microsoft Sentinel. The security team wants to use the existing Azure Monitor Agent (AMA) infrastructure and avoid deploying additional forwarding servers. You need to configure collection with the least administrative overhead while ensuring the events are stored in a custom table for long-term retention. What should you do?

Create a data collection rule (DCR) that targets the servers, selects the Windows Security Events data source, and chooses the 'All Security Events' option. Then create a custom table and a DCR transformation to route the events to the custom table.

Create a DCR that targets the servers and selects the 'Custom' data source, then manually specify the event IDs in the XPath query and set the destination to the Sentinel SecurityEvent table.

Install the Log Analytics agent on each server and configure the Windows Event Log data source in the workspace to collect event IDs 4624, 4625, and 4720.

Configure Windows Event Forwarding (WEF) to a central collector and install the Azure Monitor Agent on the collector to forward the events to Sentinel.

Your company has a mix of Windows and Linux servers. You need to collect Windows Security events and Linux Syslog into Microsoft Sentinel. You want to use a single agent type where possible. What should you do?

Use Windows Event Forwarding to send all events to a single Linux server, then use the Syslog connector.

Install the Log Analytics agent on Windows servers and the AMA on Linux servers.

Enable the Windows Security Events connector and the Syslog connector, but install the AMA only on Windows servers.

Install the Azure Monitor Agent on all servers and create separate DCRs for Windows Security events and Syslog.

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 3

Ingest Data into the Microsoft Sentinel SIEM and Platform SC-200 Practice Questions (Page 6)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

7concepts

40–45%of the exam

Questions 26–30

26application · medium
Your security team needs to ingest logs from multiple sources: Windows Security events, Linux syslog, and Azure Activity logs. You want to use the most appropriate connectors for each source. What should you do?
Select an answer first
27expert · hard
Your organization has a security appliance that sends logs in CEF format. You have a Linux server that runs AMA and is already collecting syslog from other devices. You need to ingest the CEF logs into Sentinel. The appliance does not support sending to a different port. What should you do?
Select an answer first
28application · medium
Your organization has a new Azure subscription with 50 virtual machines. You need to collect Azure activity logs (e.g., VM create, delete, and security policy changes) into Microsoft Sentinel. You want to use Azure Policy to ensure that all current and future VMs have diagnostic settings enabled. What should you do?
Select an answer first
29application · medium
Your company has 500 Windows servers that must send Security events (4624, 4625, 4720) to Microsoft Sentinel. The security team wants to use the existing Azure Monitor Agent (AMA) infrastructure and avoid deploying additional forwarding servers. You need to configure collection with the least administrative overhead while ensuring the events are stored in a custom table for long-term retention. What should you do?
Select an answer first
30application · medium
Your company has a mix of Windows and Linux servers. You need to collect Windows Security events and Linux Syslog into Microsoft Sentinel. You want to use a single agent type where possible. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Ingest Data into the Microsoft Sentinel SIEM and Platform SC-200 Practice Questions (Page 6)

Questions 26–30

Your security team needs to ingest logs from multiple sources: Windows Security events, Linux syslog, and Azure Activity logs. You want to use the most appropriate connectors for each source. What should you do?

Your organization has a security appliance that sends logs in CEF format. You have a Linux server that runs AMA and is already collecting syslog from other devices. You need to ingest the CEF logs into Sentinel. The appliance does not support sending to a different port. What should you do?

Your company has a mix of Windows and Linux servers. You need to collect Windows Security events and Linux Syslog into Microsoft Sentinel. You want to use a single agent type where possible. What should you do?

Keep studying — Manage a security operations environment