SC-200 Certification Practice Question #196

Question

You have on-premises servers that run Windows Server.

You have a Microsoft Sentinel workspace named SW1. SW1 is configured to collect Windows Security log entries from the servers by using the Azure Monitor Agent data connector.

You plan to limit the scope of collected events to events 4624 and 4625 only.

You need to use a PowerShell script to validate the syntax of the filter applied to the connector.

How should you complete the script? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The scenario validates a *DCR (Azure Monitor Agent) Windows Security event filter*, which MS Learn states is written as an XPath query (`LogName!*[System[...]]`) and tested locally with `Get-WinEvent -LogName 'Security' -FilterXPath $XPath`. The XPath dropdown value `Security!*[System[(EventID=4624 or EventID=4625)]]` is exactly the form the docs and the Optimizor_IT comment use, and the only parameter that consumes a raw XPath string is `-FilterXPath` (the hashtable and XML options belong to `-FilterHashtable`/`-FilterXml`). Confidence is held at 90 rather than higher because the file records no official Suggested Answer block, though the top-voted comment and MS Learn align cleanly.

More SC-200 practice questions