Exam SC-200 topic 3 question 1 discussion

Actual exam question from Microsoft's SC-200

Question #: 1
Topic #: 3

DRAG DROP -
You plan to connect an external solution that will send Common Event Format (CEF) messages to Azure Sentinel.
You need to deploy the log forwarder.
Which three actions should you perform in sequence? To answer, move the appropriate actions form the list of actions to the answer area and arrange them in the correct order.
Select and Place:

Show Suggested Answer

Suggested Answer:

Reference:
https://docs.microsoft.com/en-us/azure/sentinel/connect-cef-agent?tabs=rsyslog

by somsom at April 4, 2021, 8:41 p.m.

Comments

Submit Cancel

somsom

Highly Voted 4 years, 2 months ago

correct

upvoted 31 times

...

Ken88

Highly Voted 3 years, 3 months ago

Answer is correct https://docs.microsoft.com/en-us/azure/sentinel/connect-common-event-format#designate-a-log-forwarder-and-install-the-log-analytics-agent

upvoted 15 times

Lion007

2 years, 11 months ago

Correct answer. From the link Ken88 provided: 1- Installs the Log Analytics agent for Linux (also known as the OMS agent) and configures it for the following purposes: --- listening for CEF messages from the built-in Linux Syslog daemon on TCP port 25226 --- sending the messages securely over TLS to your Microsoft Sentinel workspace, where they are parsed and enriched 2- Configures the built-in Linux Syslog daemon (rsyslog.d/syslog-ng) for the following purposes: --- listening for Syslog messages from your security solutions on TCP port 514 --- forwarding only the messages it identifies as CEF to the Log Analytics agent on localhost using TCP port 25226 The need for restarting the daemon and the agent is to ensure the changes take effect (on Linux this is required)

upvoted 13 times

...

VeiN

Most Recent 7 months, 3 weeks ago

This is obsolite (maybe worth to learn ? ). Currently when using AMA with non azure machine (I assume since in description "external device") The steps I`ve done on my lab: 1. Install Azure ARC on linux Forwarder (& connect to azure subscription) 2. Install connector: Common Event Format (CEF) via AMA 3. via connector : Create Data Collection Rule, add linux forwarder ARC object + configure log types to collected) 4. execute script on forwarder: sudo wget -O Forwarder_AMA_installer.py

upvoted 6 times

...

Sneekygeek

1 year, 2 months ago

Correct but log analytics will soon be deprecated. The new guides saw to the Azure Monitoring Agent https://learn.microsoft.com/en-us/azure/sentinel/connect-cef-syslog-ama?tabs=single%2Csyslog%2Cportal

upvoted 2 times

...