Exam AZ-500 topic 4 question 65 discussion

1. Log Analytics table(s) SecurityAlert 2. Log Analytics table(s) AzureDiagnostics 3. CEF, set up the Syslog agent and then configure the CEF data flow. After successful configuration, the data appears in the CommonSecurityLog table.

1. SecurityAlert 2. AzureDiagnostics 3. CommonSecurityLog https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/azure-active-directory-identity-protection Log Analytics table(s) - SecurityAlert (IPC) https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/azure-firewall Log Analytics table(s) - AzureDiagnostics (Azure Firewall) https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/common-event-format-cef Log Analytics table(s) - CommonSecurityLog

These questions we just must memories them and there is no logic, there are hundreds of connectors, how can we memories all of them...!!!!

go through bellow link: No more AZ AD, so - Microsoft Entra ID Protection Answer provided is correct: entraID - Security Alert AZ Firewall - AzDiag CEF - Syslog https://learn.microsoft.com/en-us/azure/sentinel/data-connectors-reference

Explanation: 1. Log Analytics table(s) SecurityAlert 2. Log Analytics table(s) AzureDiagnostics 3. CEF, set up the Syslog agent and then configure the CEF data flow. After successful configuration, the data appears in the CommonSecurityLog table. Reference: https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-ad-identity-protection https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-firewall https://docs.microsoft.com/enus/ azure/sentinel/connect-data-sources

1: SecurityAlert 2: AzureDiagnostics 3: CommonSecurityLog

Box 1: SecurityAlert Box 2: AzureDiagnostics Box 3: CommonSecurityLog Table target can be found in Sentinel data connector information: Find your Microsoft Sentinel data connector https://learn.microsoft.com/en-us/azure/sentinel/data-connectors-reference

Correct

#exam ques # 29 Sep