SC-200 Certification Practice Question #123

Question

You have an Azure subscription that contains 100 Linux virtual machines.
You need to configure Microsoft Sentinel to collect event logs from the virtual machines.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

Accepted Answer

Microsoft Sentinel runs on top of a Log Analytics workspace, so the first action is enabling Sentinel on a workspace. Because the sources are **Linux** VMs, event logs arrive via **Syslog**, so the Syslog data connector is added to the workspace (the "Security Events" connector is for Windows and is eliminated; a workbook only visualizes data and is eliminated). Finally, the agent that actually collects and ships the Syslog records — the Log Analytics agent (now Azure Monitor Agent) — is installed on the Linux VMs. MS Learn's Syslog-collection guidance follows this same workspace → connector → agent flow. The community is overwhelmingly aligned (46 + 23 + 7 + 7 👍 on this exact order). Confidence is held in the mid-80s rather than higher because the file records no official Suggested Answer and the underlying agent is now the AMA (the legacy "Log Analytics agent" wording is deprecated), though the relative ordering is unchanged.

More SC-200 practice questions