SC-200 Practice Question 3685
Exam: SC-200
Domain: Manage a security operations environment
Difficulty: medium
What is the purpose of configuring a Data Collection Rule (DCR) when setting up the Azure Monitor Agent for Windows Security Events?
Answer Options
A
Defines specific event streams/XPath filters and destination workspaces
B
Overclocks the client computer processor during log bursts
C
Formats the local hard drive if an unauthorized login occurs
D
Translates log messages into Latin
Correct Answer
A: Defines specific event streams/XPath filters and destination workspaces
Explanation
Data Collection Rules (DCRs) define which specific Windows Event IDs (or filtered XPath queries) to collect and specify which Log Analytics workspace and table to send them to.