SC-200 Certification Practice Question #95

Question

You create an Azure subscription named sub1.

In sub1, you create a Log Analytics workspace named workspace1.

You enable Microsoft Defender for Cloud and configure Defender for Cloud to use workspace1.

You need to collect security event logs from the Azure virtual machines that report to workspace1.

What should you do?

Accepted Answer

To actually collect Windows security event logs from the Azure VMs that report to workspace1, you configure data collection within the Microsoft Defender for Servers plan — the Defender for Cloud plan settings control the agent/data-collection rule that ships SecurityEvent data into the workspace. MS Learn's "Review and modify Defender for Servers settings" and the Defender-for-Servers data-collection guidance both place security-event ingestion under the plan's Settings and monitoring, confirming A. The Suggested Answer, the unanimous Most Voted (10 votes), and an explicit "guarantee" comment all align. The only dissent (D, create a workbook) is well-rebutted by a higher-voted comment noting workbooks merely visualize data rather than collect it. Confidence is held just below 90 because one commenter notes the question is now legacy following the September-2024 MMA/Log-Analytics-agent retirement, but A remains the keyed and best answer among the four choices.

More SC-200 practice questions