SC-200 Certification Practice Question #55

Question

You create an Azure subscription named sub1.
In sub1, you create a Log Analytics workspace named workspace1.
You enable Azure Security Center and configure Security Center to use workspace1.
You need to collect security event logs from the Azure virtual machines that report to workspace1.
What should you do?

Accepted Answer

The goal is to start collecting security event logs from VMs reporting to workspace1 after Security Center is already pointed at that workspace. In (Azure) Security Center / Defender for Cloud, this is governed by the Data collection (auto-provisioning) setting, where you choose to store raw Windows security events in the Log Analytics workspace. The official Suggested Answer (A), a unanimous community vote (19), and two highly detailed top comments all agree, and MS Learn confirms Defender for Cloud reads security event logs from the machine and copies them to your workspace once data collection is enabled. The other choices (provider registration, workflow automation, workbook) do not initiate security-event ingestion. Slight reduction from a perfect score only because the portal UI has since moved to Azure Monitor Agent + Data Collection Rules, but the answer key remains A.

More SC-200 practice questions