SC-100 Certification Practice Question #242

Question

You have an Azure subscription that contains a Microsoft Sentinel workspace named MWS1 and an Azure Data Lake Storage account named lake1. Firewall log data is ingested into MWS1.

You plan to export historical firewall log data from MWS1 to lake1.

You need to ensure that security analysts can perform threat hunting from MWS1. The solution must ensure that the firewall logs stored in lake1 can be included in threat hunting queries.

What should you configure? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Two requirements must each be satisfied. First, to let analysts perform threat hunting over firewall logs that now live in lake1 (a Data Lake), the Sentinel feature is a **notebook** — Jupyter/MSTICPy notebooks can query both the workspace and external data sources such as a data lake, whereas playbooks (SOAR) and TI connectors do neither. Second, to move historical firewall logs out of MWS1 into lake1 in a format a notebook can read (Parquet), the right Azure resource is an **Azure Data Factory pipeline**: MS Learn's Log Analytics data-export guidance names Data Factory as the orchestration service for exporting historical workspace data, and ADF natively writes Parquet to ADLS. Logic Apps targets lightweight automation and Synapse is an analytics engine rather than the export mechanism. Confidence is 84 rather than higher because there is a community/dissent split on the resource (Synapse vs ADF), but both top-voted comments and MS Learn favor ADF.

More SC-100 practice questions