SC-200 Certification Practice Question #189

Question

You have a Microsoft Sentinel workspace that contains Common Event Format (CEF) data.

You need to run a query against the CEF data.

Which table should you query?

Accepted Answer

Common Event Format (CEF) is a vendor-neutral extension of Syslog used by firewalls and security appliances. When CEF messages are ingested into Microsoft Sentinel via the Azure Monitor Agent, they are parsed into the **CommonSecurityLog** table, whereas plain Syslog messages land in the Syslog table. MS Learn states this explicitly and provides a dedicated CEF-to-CommonSecurityLog field-mapping reference, confirming CEF data is queried from CommonSecurityLog. SecurityEvent (B) holds Windows security events, Syslog (A) holds non-CEF syslog, and option D ("TrreatIntelligentIndicator") is a misspelled, nonexistent table. Suggested Answer C aligns with the authoritative documentation.

More SC-200 practice questions