Microsoft Exam SC-100 Topic 2 Question 53 Discussion

Actual exam question for Microsoft's SC-100 exam

Question #: 53
Topic #: 2

You have an Azure subscription that contains a Microsoft Sentinel workspace.

Your on-premises network contains firewalls that support forwarding event logs m the Common Event Format (CEF). There is no built-in Microsoft Sentinel connector for the firewalls

You need to recommend a solution to ingest events from the firewalls into Microsoft Sentinel.

What should you include m the recommendation?

Aan Azure logic app

Ban on-premises Syslog server

Can on-premises data gateway

DAzure Data Factory

Show Suggested Answer

Suggested Answer: B

by India at Sep 17, 2024, 01:18 AM

Limited Time Offer

25%

Off

Get Premium SC-100 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Rosendo

7 months ago

Ooh, the Syslog server option sounds like a good one. Plus, it's nice to have an on-premises component to handle the initial log collection.

upvoted 0 times

Cristen

6 months ago

User 3: I agree, the Syslog server option seems like the way to go for this scenario.

upvoted 0 times

...

Genevive

6 months ago

User 2: Yeah, having an on-premises component for log collection is a smart move.

upvoted 0 times

...

Quentin

6 months ago

User 1: I think the Syslog server is a good choice for ingesting events from the firewalls.

upvoted 0 times

...

Ben

7 months ago

Haha, I bet the correct answer is the one that's the most convoluted and complicated. That's how these exams love to trick you! I'm going with D, Azure Data Factory.

upvoted 0 times

Margery

6 months ago

Yeah, Azure Data Factory might be overkill. Let's go with an Azure logic app.

upvoted 0 times

...

Daren

6 months ago

I agree, an Azure logic app would be a simpler solution.

upvoted 0 times

...

Donette

6 months ago

I think Azure Data Factory is too complex for this scenario.

upvoted 0 times

...

Viola

7 months ago

But wouldn't option C) an on-premises data gateway be more secure and efficient?

upvoted 0 times

...

Roselle

7 months ago

I disagree, I believe option B) an on-premises Syslog server would be a better choice.

upvoted 0 times

...

Viola

7 months ago

I think we should go with option A) an Azure logic app.

upvoted 0 times

...

Melissia

7 months ago

I agree with Louis. Using a Syslog server seems like the most straightforward way to get those on-premises firewall logs into Sentinel.

upvoted 0 times

...

Myra

7 months ago

Hmm, I'm not sure. Could an Azure Logic App work too? It might be able to ingest the logs directly from the firewalls.

upvoted 0 times

Jamal

6 months ago

C) an on-premises data gateway

upvoted 0 times

...

Gregg

7 months ago

B) an on-premises Syslog server

upvoted 0 times

...

Maryln

7 months ago

A) an Azure logic app

upvoted 0 times

...

Louis

8 months ago

I think the answer is B. An on-premises Syslog server. Since there's no built-in connector, we'll need to forward the CEF logs to a Syslog server first, and then connect that to Microsoft Sentinel.

upvoted 0 times