SC-200 Certification Practice Question #147

Question

You have an Azure subscription that is linked to a hybrid Azure AD tenant and contains a Microsoft Sentinel workspace named Sentinel1.

You need to enable User and Entity Behavior Analytics (UEBA) for Sentinel and configure UEBA to use data collected from Active Directory Domain Services (AD DS).

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

UEBA's on-premises Active Directory user-entity synchronization requires the Azure tenant to be onboarded to Microsoft Defender for Identity with the MDI sensor installed on the AD DS domain controllers — so Row 1 is "Microsoft Defender for Identity sensors." For Sentinel to ingest the on-prem domain-controller security/logon events that UEBA analyzes, the Security Events data source must be configured (it maps to WindowsEvent/SecurityEvent rows such as 4624/4625/4672/4688) — so Row 2 is "The Security Events data source." The Audit Logs and Sign-in Logs options are Microsoft Entra ID cloud data sources, not AD DS, and the Azure Connected Machine / Azure Monitor agents don't drive AD identity sync into UEBA. The top community comment (13 👍) and MS Learn agree.

More SC-200 practice questions