Exam SC-200 topic 3 question 47 discussion

1 - Event Hub: https://docs.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem#stream-alerts-with-continuous-export 2 - Azure Policy - https://docs.microsoft.com/en-us/azure/defender-for-cloud/continuous-export?tabs=azure-policy#configure-continuous-export-at-scale-using-the-supplied-policies

1st Azure Event hub 2nd Azure Policy Both answers are in this link: https://learn.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem#stream-alerts-with-continuous-export To stream alerts into //Syslog servers// ,and other monitoring solutions, connect Defender for Cloud using continuous export and Azure Event Hubs. Note: To stream alerts at the tenant level, use this //Azure policy// and set the scope at the root management group.

Event Hub Azure Policy

Event Hub and Azure Policy

Exports logs to an ---- C. Log Analytics workspace Configure streaming by ---- B. Create an azure policy assignment at the root management group

Between Log Analytics Workspace and Event Hubs, using Log Analytics Workspace requires less administrative effort. With Log Analytics Workspace, you can configure Defender for Cloud to stream logs to the workspace and then set up a Log Analytics action group to forward the logs to the syslog server. This can be done in the Azure portal, which provides a simple and intuitive interface for setting up log forwarding. In comparison, using Event Hubs requires you to set up and configure the Event Hubs Forwarder or an event hub consumer to stream the logs from the Event Hub to the syslog server. This may require additional setup and configuration, which can increase the administrative effort required to stream the Defender for Cloud logs to a syslog server. Therefore, if you want to minimize administrative effort, I would recommend using Log Analytics Workspace to stream the Defender for Cloud logs to a syslog server.

As the question asks that 'the solution must minimize administrative effort' - configuring 100 subscriptions can't be correct, so the answer is Event Hub and Azure Policy.

Correct Answer: Azure Event Hub Continuous Config https://learn.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem

CORRECT Minimize administrative effort... https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-about https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace-overview https://learn.microsoft.com/en-us/azure/defender-for-cloud/continuous-export?tabs=azure-portal

"Export logs to an" answer is wrong. The question says to export to a Syslog and Syslog is not used by Microsoft Sentinel since is already natively integrated, the answer should be Event Hub. https://docs.microsoft.com/en-us/azure/defender-for-cloud/export-to-siem