SC-200 Question 25

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  To enable a third-party SIEM to receive Azure AD sign-in events in near real time, the best approach is to: Configure diagnostic settings in Azure AD Stream the logs to an Azure Event Hub Connect your SIEM to the Event Hub This setup allows your SIEM to ingest logs as they are generated, enabling near real-time alerting and analysis.

• 1

  B correct

• Chose B1

  Correct is B