SC-100 Practice Question 3922
Exam: SC-100
Domain: Design security operations, identity, and compliance capabilities
Difficulty: medium
In designing Microsoft Sentinel data collection, what is the role of Data Collection Rules (DCRs) when using the Azure Monitor Agent (AMA)?
Answer Options
A
Defines data streams, XPath event filters, and destination workspaces
B
Overclocks VM processors during heavy analytical workloads
C
Formats VM hard drives when security incidents occur
D
Translates log messages into alternate spoken languages
Correct Answer
A: Defines data streams, XPath event filters, and destination workspaces
Explanation
Data Collection Rules (DCRs) define the specific data streams, event filtering criteria (such as XPath queries for Windows Security Events), and destination Log Analytics workspaces for collected logs.