Which agent is used by the Windows Security Events via AMA connector to collect Windows Security events from machines into Microsoft Sentinel?

Microsoft Monitoring Agent (MMA)

Your organization has a management group with multiple subscriptions. You need to collect Azure activity logs from all subscriptions into a single Sentinel workspace. You want to automate the process for new subscriptions. What should you do?

Use the 'Azure Activity' data connector and enable it for each subscription.

Assign an Azure Policy initiative at the management group level that deploys diagnostic settings for the Activity log to the Sentinel workspace.

Create a custom log table and use a Logic App to collect activity logs from each subscription.

Create a diagnostic setting for each subscription manually.

A security operations team wants to ingest Windows Security events from on-premises servers into Microsoft Sentinel. Which data connector should they use?

Windows Security Events via AMA

Which Microsoft Sentinel data connector is used to ingest Syslog messages from network appliances using the Azure Monitor Agent?

Windows Security Events via AMA

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 3

Ingest Data into the Microsoft Sentinel SIEM and Platform SC-200 Practice Questions (Page 7)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

7concepts

40–45%of the exam

Questions 31–35

31foundation · easy
Which Azure feature is used to collect Azure Activity logs into a Log Analytics workspace for Microsoft Sentinel?
Select an answer first
32foundation · easy
Which agent is used by the Windows Security Events via AMA connector to collect Windows Security events from machines into Microsoft Sentinel?
Select an answer first
33application · medium
Your organization has a management group with multiple subscriptions. You need to collect Azure activity logs from all subscriptions into a single Sentinel workspace. You want to automate the process for new subscriptions. What should you do?
Select an answer first
34foundation · easy
A security operations team wants to ingest Windows Security events from on-premises servers into Microsoft Sentinel. Which data connector should they use?
Select an answer first
35foundation · easy
Which Microsoft Sentinel data connector is used to ingest Syslog messages from network appliances using the Azure Monitor Agent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.