sc-900 Practice Question 1797
Exam: sc-900
Domain: Describe the capabilities of Microsoft security solutions
Topic: Describe Microsoft Defender and Sentinel
Difficulty: medium
Contoso Ltd has recently adopted a hybrid cloud configuration with both on-premises and Azure environments. They want to ensure that their Microsoft Sentinel workspace can effectively monitor and correlate events across both environments. What is the best approach to achieve this? Explain your choice and why the other options are not suitable.
Answer Options
A
Use separate SIEM tools for on-premises and Azure environments.
B
Configure Data Connectors in Azure Monitor to collect logs from both environments and correlate them in Microsoft Sentinel.
C
Deploy third-party SIEM tools to integrate with both environments.
D
Write custom scripts to manually collect and correlate logs.
Correct Answer
B: Configure Data Connectors in Azure Monitor to collect logs from both environments and correlate them in Microsoft Sentinel.
Explanation
The correct answer is B. Use the Azure Monitor Logs to collect logs from both on-premises and Azure environments and then correlate them in Microsoft Sentinel. This can be done by configuring Data Connectors in Azure Monitor to collect logs from on-premises sources and then ingesting these logs into Microsoft Sentinel for analysis. Option A is incorrect because it suggests using separate SIEM tools for each environment, which would not provide a unified view across both environments. Option C is incorrect as it refers to using third-party tools which may not integrate seamlessly with Microsoft Sentinel. Option D is incorrect as it suggests configuring custom scripts which would be complex and less efficient than using built-in features.