SC-200 Practice Question 3674
Exam: SC-200
Domain: Manage a security operations environment
Difficulty: medium
You need to connect an on-premises network firewall that exports Common Event Format (CEF) logs over Syslog to Microsoft Sentinel. What component acts as the intermediate forwarder?
Answer Options
A
A dedicated Linux Log Forwarder running AMA and a Syslog daemon
B
An on-premises Windows DNS server
C
An Azure Application Gateway
D
A direct USB cable connection to an Azure host
Correct Answer
A: A dedicated Linux Log Forwarder running AMA and a Syslog daemon
Explanation
A dedicated Linux Log Forwarder virtual machine running the Azure Monitor Agent (AMA) and a Syslog daemon (rsyslog or syslog-ng) receives CEF over UDP/TCP 514 and securely streams it to Sentinel.