SC-200 Exam Dumps : Microsoft Security Operations Analyst

When configuring the Syslog via Azure Monitor Agent (AMA) connector in Microsoft Sentinel , the Data Collection R ule (DCR) determines which Linux system logs are ingested. Syslog messages are filtered based on facility (the subsystem that generated the message) and severity level (priority) .

According to Microsoft’s “Collect Syslog data sources using Azure Monitor Ag ent” documentation:

“Syslog facilities define which type of process generated the log (e.g., authentication, cron, daemon), and log levels define the severity (0=emerg, 1=alert, 2=crit, 3=err, etc.). To minimize data ingestion and cost, select only the fac ility and the highest severity level required for your investigation.”

In this scenario:

You need to collect logs related to App1 , a background process (non-kernel, non-authentication, non-cron). Typically, such custom or application-level processes send logs to LOG_AUTH or LOG_DAEMON , depending on configuration. If App1 is an application that uses authentication or security features, the LOG_AUTH facility is appropriate.

You must collect only logs with a critical priority , which corresponds to Syslog severity 2 (critical) . In Syslog terminology, that maps to the LOG_EMERG or “emergency” level and above.

However, to ensure minimum data collection while still capturing critical events, Sentinel’s best practice is to configure the Syslog DCR to collect on ly the specific facility associated with the application and the exact required severity level. For “critical only,” LOG_EMERG is the correct choice because it ensures that only the most urgent (critical/emergency) events are ingested, reducing data volume and cost.

✅ Final Configuration:

Setting

Correct Option

Purpose

Facility

LOG_AUTH

Collects security/authentication-related logs for App1

Log level

LOG_EMERG

Collects only critical/emergency events (priority ≤ 0) to minimize ingestion volume

In summary:

Selecting LOG_AUTH and LOG_EMERG satisfies both requirements — capturing only the highest-severity logs relevant to App1 while keeping the ingestion volume minimal, in line with Microsoft Sentinel Syslog DCR configuration guidance.

In Microsoft Defender for Identity (MDI) , data collected from Active Directory Domain Serv ices (AD DS) is stored in Microsoft 365 Defender advanced hunting tables under the Identity schema.

When investigating LDAP or authentication activities related to domain controllers, the correct table is IdentityLogonEvents .

The IdentityLogonEvents table contains information about all logons detected by Defender for Identity sensors on domain controllers — including LDAP binds , Kerberos , NTLM , and other authentication types.

You can identify LDAP simple binds using a query such as:

IdentityLogonEvents

| wh ere Protocol == " LDAP "

| where AuthenticationPackage == " SimpleBind "

Other options explained:

AADServicePrincipalRiskEvents – Contains Entra (Azure AD) service principal risk detections, not AD DS activity.

AADDomainServicesAccountLogon – Used for Azure AD Domain Services (AAD DS), not traditional on-prem AD DS.

SigninLogs – Contains Entra (Azure AD) sign-in data, not LDAP or on-prem authentication.

✅ Correct table: IdentityLogonEvents