SC-200 Certification Practice Question #265

Question

You need to configure the Azure Sentinel integration to meet the Azure Sentinel requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Accepted Answer

Connecting Defender for Cloud Apps (formerly MCAS) to Microsoft Sentinel is a two-portal task. In the Cloud App Security portal you add the SIEM/security extension (Add SIEM agent → Sentinel) — among the offered options only "Add a security extension" is the SIEM integration entry point ("Configure app connectors" and "Configure log collectors" are unrelated discovery features). On the Sentinel side you enable ingestion by adding the "Microsoft Defender for Cloud Apps" data connector, so "Add a data connector" is correct over "Add a workbook" (visualization only) or "Configure the Logs settings." The top community thread (23 👍) describes exactly this flow and MS Learn confirms configuration happens in both portals. Confidence is held at 88% rather than higher because the file has no Suggested Answer block and the MDCA UI has since migrated into the Defender portal, though the conceptual answer is unchanged.

More SC-200 practice questions