HOTSPOT You have an Azure subscription named Sub1. Sub1 contains a Microsoft Sentinel workspace named SW1 and a virtual machine named VM1 that runs Windows Server. SW1 collects security logs from VM1 by using the Windows Security Events via AMA connector. You need to limit the scope of events collected from VM1. The solution must ensure that only audit failure events are collected. How should you complete the filter expression for the connector? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Select one answer.
Purchase Full Access to view answer options & explanation
The first 125 questions in this bank are completely free. Unlock Full Access on the exam page to view all answer choices, verified answers, explanations, and community discussions for all 415 questions.
