Microsoft Sentinel Integration Quiz

5 questions Pass: 70% +25 pts (50 with Pro)

Quiz covering Implement Endpoint Security

What you'll be asked

  1. Which agent is primarily responsible for collecting security events from Windows Servers and forwarding them to a Microsoft Sentinel workspace?
  2. You need to ensure that specific Windows Security Event logs (such as Event ID 4624) are ingested into Sentinel. Where should you configure this collection?
  3. When configuring a Windows Server to report to Sentinel, what is the primary purpose of the 'Security Events' connector?
  4. A security analyst wants to correlate Windows Server logs with network traffic logs in Sentinel. What is the prerequisite for this to work effectively?
  5. You have deployed the Azure Monitor Agent to a fleet of Windows Servers. Despite the agent showing a 'Healthy' status, no security events are appearing in your Sentinel workspace. What is the most likely cause?

Answers and explanations come after you submit.