Exam SC-200 topic 1 question 25 discussion

Actual exam question from Microsoft's SC-200

Question #: 25
Topic #: 1

You have a third-party security information and event management (SIEM) solution.
You need to ensure that the SIEM solution can generate alerts for Azure Active Directory (Azure AD) sign-events in near real time.
What should you do to route events to the SIEM solution?

A. Create an Azure Sentinel workspace that has a Security Events connector.
B. Configure the Diagnostics settings in Azure AD to stream to an event hub.
C. Create an Azure Sentinel workspace that has an Azure Active Directory connector.
D. Configure the Diagnostics settings in Azure AD to archive to a storage account.

Show Suggested Answer

Suggested Answer: B 🗳️

by rdy4u at April 27, 2022, 6:06 p.m.

Comments

Submit Cancel

rdy4u

Highly Voted 3 years, 2 months ago

Routing logs to an Azure event hub allows you to integrate with third-party SIEM tools like Sumologic and Splunk. https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/tutorial-azure-monitor-stream-logs-to-event-hub

upvoted 17 times

...

sdbol

Most Recent 2 months ago

Selected Answer: B

To enable a third-party SIEM to receive Azure AD sign-in events in near real time, the best approach is to: Configure diagnostic settings in Azure AD Stream the logs to an Azure Event Hub Connect your SIEM to the Event Hub This setup allows your SIEM to ingest logs as they are generated, enabling near real-time alerting and analysis.

upvoted 1 times

...