SC-200 · Domain 1: Manage a security operations environment · 41% of the exam
Task 1.3: Ingest data into the Microsoft Sentinel SIEM and platform
Choosing data connectors, Windows Security Events via AMA and Windows Event Forwarding, Syslog and CEF via AMA, Azure activity logs through diagnostic settings and Azure Policy, threat indicators, and custom tables.
Study it
Choosing connectors: Windows Security Events via AMA and Windows Event Forwarding
Lesson coming
Syslog and CEF via AMA: log forwarders, facilities and duplication
Lesson coming
Azure activity and resource logs through diagnostic settings and Azure Policy
Lesson coming
Threat intelligence: Defender Threat Intelligence, TAXII and the upload API
Lesson coming
Custom tables, data collection rules and the Logs Ingestion API
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
You collect domain controller security events through Windows Event Forwarding to a collector that runs the Azure Monitor Agent, using the Windows Forwarded Events connector. Events arrive, but several built-in Windows security analytics rules never fire on known test activity. What explains this?
AForwarded events need the Common event set selected on the collector
BThe collector machine needs Azure Arc installed before analytics rules can read its events
CThe forwarded events are in WindowsEvent, while those rules query SecurityEvent
DNRT rules can't read events that pass through a collector
Show the answer and why
AForwarded events need the Common event set selected on the collector
Incorrect
Event sets belong to the Windows Security Events connector, not the forwarded events connector.
BThe collector machine needs Azure Arc installed before analytics rules can read its events
Incorrect
Data is already arriving, so connectivity isn't the issue.
CThe forwarded events are in WindowsEvent, while those rules query SecurityEvent
Correct
The forwarded events connector writes to WindowsEvent, and many built-in rules query SecurityEvent.
DNRT rules can't read events that pass through a collector
Incorrect
The table is the issue, not the forwarding hop.
Events collected through Windows Event Forwarding, including Security log events, are written to WindowsEvent. Many built-in Windows Security Events rules query SecurityEvent. Use the Windows Security Events via AMA connector on the source machines, or adapt the rules to WindowsEvent or ASIM parsers.
Auditors need a full user audit trail from Windows servers, including both sign-in and sign-out events (4624 and 4634), at the lowest volume a predefined set allows. Which event set do you choose in the Windows Security Events via AMA connector?
AAll events
BMinimal
CCommon
DCustom with no XPath queries
Show the answer and why
AAll events
Incorrect
It collects the full unfiltered Security and AppLocker logs, the largest volume.
BMinimal
Incorrect
Minimal keeps sign-ins but drops sign-out events such as 4634.
CCommon
Correct
Common keeps a full user audit trail, including 4624 and 4634, at a reduced volume.
DCustom with no XPath queries
Incorrect
A custom set collects what XPath queries define, so with none it collects nothing useful.
The Common set is a standard auditing set that keeps a full user audit trail, including sign-in and sign-out (4624, 4634). Minimal covers events that might indicate a breach and omits sign-outs. All events collects everything from the Security and AppLocker logs.
A firewall sends both plain Syslog and CEF messages to a Linux log forwarder on the same facility, and its facility can't be changed. Both the Syslog via AMA and CEF via AMA connectors are configured, and the same events appear in Syslog and CommonSecurityLog. How do you stop the duplication?
AAdd a Syslog DCR transformation that drops messages showing CEF
BPoint the firewall at TCP port 28330 on the forwarder
CSet the Syslog DCR's minimum log level to LOG_EMERG
DRemove the CEF via AMA connector and parse the CEF fields from the Syslog table with a function instead
Show the answer and why
AAdd a Syslog DCR transformation that drops messages showing CEF
Correct
When the source facility can't change, an ingestion-time transformation filters CEF out of the Syslog stream.
BPoint the firewall at TCP port 28330 on the forwarder
Incorrect
Port 28330 is the local port AMA uses to receive from the syslog daemon, not a device target.
CSet the Syslog DCR's minimum log level to LOG_EMERG
Incorrect
That drops nearly all Syslog data instead of only the duplicates.
DRemove the CEF via AMA connector and parse the CEF fields from the Syslog table with a function instead
Incorrect
CEF is meant to land parsed in CommonSecurityLog, which content relies on.
Using one facility for both Syslog and CEF duplicates data between the Syslog and CommonSecurityLog tables. If the device's facility can't be changed, add an ingestion-time transformation to the Syslog DCR, for example where ProcessName !contains "CEF" and SyslogMessage !contains "CEF:0".
You connect an Azure service through a diagnostic settings connector that Azure Policy manages, scoped to a subscription. Resources created after the assignment send logs, but the 30 resources that already existed don't. What did the assignment miss?
AA second assignment of the same policy at each resource group
BA remediation task created in the Remediation tab
CThe Owner role on the Log Analytics workspace
DFourteen days of waiting for the connector status to turn green
Show the answer and why
AA second assignment of the same policy at each resource group
Incorrect
Policy applies the setting when resources are created; another assignment doesn't touch existing resources either.
BA remediation task created in the Remediation tab
Correct
The policy applies to new resources; a remediation task applies it to existing ones.
CThe Owner role on the Log Analytics workspace
Incorrect
Owner is needed on the policy assignment scope, and the assignment already works for new resources.
DFourteen days of waiting for the connector status to turn green
Incorrect
The status only reflects whether data arrived in the past 14 days; it doesn't start collection.
For connectors managed by Azure Policy, the assigned policy applies the diagnostic setting to resources added in the future. To cover resources that already exist, mark Create a remediation task on the Remediation tab of the policy assignment wizard.
Your threat intelligence platform can push STIX indicators, threat actors and attack patterns over REST to Microsoft Sentinel. You want the supported, current method that doesn't depend on a deprecated API. Which method do you use?
AThe Threat Intelligence Platforms data connector
BThe Threat Intelligence - TAXII data connector
CBulk import of the platform's exports from a CSV or JSON file each day
DThe threat intelligence upload API with a Microsoft Entra app
Show the answer and why
AThe Threat Intelligence Platforms data connector
Incorrect
It uses the Graph tiIndicators API, handles indicators only, and was set to stop collecting data in June 2026.
BThe Threat Intelligence - TAXII data connector
Incorrect
It pulls from a TAXII 2.x server; the platform pushes over REST.
CBulk import of the platform's exports from a CSV or JSON file each day
Incorrect
File import is a manual bulk load, not a platform integration.
DThe threat intelligence upload API with a Microsoft Entra app
Correct
The upload API takes STIX objects, needs no data connector, and the app needs Microsoft Sentinel Contributor.
The upload API imports STIX objects from a TIP or custom application without a data connector; the Microsoft Entra application needs the Microsoft Sentinel Contributor role at the workspace. The Threat Intelligence Platform connector is limited to indicators through the tiIndicators API; it's deprecated, and Microsoft set it to stop collecting data in June 2026.
A custom application must send JSON records to a new table AppAudit_CL through the Logs Ingestion API, with no private link. You created the table in the portal from a sample file. Which two items do you still need for the application's calls to succeed? (Choose TWO.)
AAn app registration and secret the application signs in with
BA data collection endpoint linked to the DCR
CThe Log Analytics agent installed on the application server
DThe Contributor role for the app on the Log Analytics workspace
EThe Monitoring Metrics Publisher role for the app on the DCR
Show the answer and why
AAn app registration and secret the application signs in with
Correct
The API call authenticates with an app registration's client ID, tenant ID and secret.
BA data collection endpoint linked to the DCR
Incorrect
The portal wizard already links a DCE to the DCR it creates, and a DCE is needed only for private link or a DCR without a logs ingestion endpoint.
CThe Log Analytics agent installed on the application server
Incorrect
The API takes REST calls from any application; no agent is involved.
DThe Contributor role for the app on the Log Analytics workspace
Incorrect
Access is granted on the DCR, not on the workspace.
EThe Monitoring Metrics Publisher role for the app on the DCR
Correct
The application must be granted access to the DCR with this role.
Creating a custom table in the portal also creates the DCR and its transformation. The application then authenticates with an app registration and must be granted Monitoring Metrics Publisher on the DCR. A DCE is required only with private link or for a DCR without the logs ingestion endpoint.
You want to collect Windows security events from on-premises servers with the Windows Security Events via AMA connector. What must the servers have before you enable the connector?
AThe legacy Log Analytics agent
BA Syslog daemon
CAzure Arc installed and enabled
DWindows Event Forwarding to an Azure VM
Show the answer and why
AThe legacy Log Analytics agent
Incorrect
AMA connectors replace the legacy agent.
BA Syslog daemon
Incorrect
Syslog is for Linux sources.
CAzure Arc installed and enabled
Correct
Systems that aren't Azure VMs need Azure Arc before you enable an AMA-based connector.
DWindows Event Forwarding to an Azure VM
Incorrect
Forwarding is a different design, not a prerequisite.
To collect events from any system that isn't an Azure virtual machine, such as on-premises or other-cloud Windows servers, the system must have Azure Arc installed and enabled before you enable the AMA-based connector.
You already use the standard Defender Threat Intelligence data connector. What does the premium version of the connector add?
AMicrosoft's curated IOCs and Microsoft-enriched open-source intelligence
BA TAXII server you can share with partners
CSTIX import from your own threat intelligence platform
DAutomatic blocking of matching IPs on firewalls
Show the answer and why
AMicrosoft's curated IOCs and Microsoft-enriched open-source intelligence
Correct
These are what the premium connector ingests beyond the standard one.
BA TAXII server you can share with partners
Incorrect
The connector imports intelligence; it doesn't host a TAXII server.
CSTIX import from your own threat intelligence platform
Incorrect
The connector brings in Microsoft's intelligence, not your platform's.
DAutomatic blocking of matching IPs on firewalls
Incorrect
The connector brings in intelligence for monitoring, alerting and hunting.
Defender Threat Intelligence data connectors come in standard and premium versions. The premium connector ingests Microsoft-enriched open-source intelligence and Microsoft's curated IOCs, beyond the public indicators the standard version provides.
A sharing community publishes STIX indicators on a TAXII 2.1 server. Besides credentials, what do you need from the community to configure the Threat Intelligence - TAXII data connector?
AA Microsoft Entra app with Microsoft Sentinel Contributor
BA CSV export of the community's indicators
CA premium Defender Threat Intelligence license
DThe TAXII server's API root and collection ID
Show the answer and why
AA Microsoft Entra app with Microsoft Sentinel Contributor
Incorrect
The connector signs in to the TAXII server; it doesn't use an app registration.
BA CSV export of the community's indicators
Incorrect
That's for bulk file import.
CA premium Defender Threat Intelligence license
Incorrect
TAXII feeds don't need a Microsoft license.
DThe TAXII server's API root and collection ID
Correct
The connector's TAXII client needs the API root and collection ID.
The Threat Intelligence - TAXII connector has a built-in TAXII client that imports STIX threat intelligence from TAXII 2.0 or 2.1 servers. To configure it, get the TAXII server API root and collection ID.
Some subscriptions still send Azure Activity logs to Microsoft Sentinel through the connector's legacy method. You want them on the current diagnostic settings pipeline. What do you do first on the Azure Activity connector page?
AInstall the Azure Monitor Agent on a VM in each subscription
BDisconnect the subscriptions from the legacy method with Disconnect All
CCreate a data collection rule for the Activity log
DDelete the AzureActivity table so it can be recreated
Show the answer and why
AInstall the Azure Monitor Agent on a VM in each subscription
Incorrect
Azure collects activity log entries by default without an agent; a diagnostic setting sends them on.
BDisconnect the subscriptions from the legacy method with Disconnect All
Correct
Legacy connections must be removed before you set up the new connector.
CCreate a data collection rule for the Activity log
Incorrect
This connector uses diagnostic settings, not an agent DCR.
DDelete the AzureActivity table so it can be recreated
Incorrect
Deleting the table loses data and isn't part of the change.
The Azure Activity connector now uses the diagnostic settings pipeline. If you use the legacy method, disconnect the existing subscriptions from it, for example with Disconnect All on the connector page, before setting up the new connector through diagnostic settings.