SC-100 Certification Practice Question #9

Question

Your company uses Microsoft Defender for Cloud and Microsoft Sentinel.
The company is designing an application that will have the architecture shown in the following exhibit.

You are designing a logging and auditing solution for the proposed architecture. The solution must meet the following requirements:
✑ Integrate Azure Web Application Firewall (WAF) logs with Microsoft Sentinel.
✑ Use Defender for Cloud to review alerts from the virtual machines.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Accepted Answer

To integrate Azure WAF logs with Microsoft Sentinel, you use the built-in Azure Web Application Firewall (WAF) data connector in Sentinel — MS Learn explicitly directs you to Configuration > Data Connectors and the WAF connector. To have Defender for Cloud review alerts from the virtual machines, the VMs need the monitoring agent installed, which at the time this question was authored was the Log Analytics agent; Defender for Cloud consumes the agent's telemetry to raise VM alerts. The community converges on this pairing (26 and 21 👍 confirmations). Confidence is 86 rather than higher because, as several recent comments note, the Log Analytics agent has since been deprecated in favor of the Azure Monitor Agent and some current exam versions drop the "Log Analytics agent" option — but for the choices presented in this image it remains the correct VM selection.

More SC-100 practice questions