SC-200 Practice Question 3799

Exam: SC-200
Domain: Respond to security incidents
Difficulty: medium
An attacker placed a web shell on an Azure virtual machine running IIS. Which table in Microsoft Sentinel captures HTTP requests and anomalous POST traffic hitting the web server?

Answer Options

A
The W3CIISLog table
B
The Heartbeat table
C
The Perf table
D
The SecurityBaseline table

Correct Answer

A: The W3CIISLog table

Explanation

The W3CIISLog table records web server access logs, capturing client IP, URI stem, HTTP status codes, user agents, and payload sizes.
Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/w3ciislog

Related Practice Questions

SC-200 Practice Question 3667SC-200 Practice Question 3668SC-200 Practice Question 3669