SC-200 Certification Practice Question #61

Question

You have an Azure subscription that has Azure Defender enabled for all supported resource types.
You need to configure the continuous export of high-severity alerts to enable their retrieval from a third-party security information and event management (SIEM) solution.
To which service should you export the alerts?

Accepted Answer

Defender for Cloud's continuous export feature streams security alerts and recommendations to exactly two targets: a Log Analytics workspace or an Azure Event Hub. To feed a third-party SIEM (Splunk, QRadar, ArcSight, etc.) you must export to Azure Event Hubs and then connect the SIEM to that event hub — Log Analytics is not offered as a choice here, leaving Event Hubs as the only valid SIEM-integration target. The official Suggested Answer, the unanimous community vote, the highly-voted HSBNZ comment, and MS Learn all converge on C. Cosmos DB and Data Lake are general-purpose storage services not selectable in continuous export, and Event Grid is not a continuous-export destination, so all three are eliminated.

More SC-200 practice questions