AZ-305 Practice Question: Design identity, governance, and monitoring solutions
Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to collect logs from on-premises firewalls and send them to Sentinel. Which TWO connectors can you use? (Choose two.)
⚠ Common exam trap
Many exam-takers confuse 'Syslog' with 'DNS' or 'Windows Security Events' because they think any log source can be collected via a generic connector, but Sentinel requires specific connectors for each data source type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Syslog
Syslog is a standard protocol for sending log messages from network devices, including firewalls, to a central collector. Common Event Format (CEF) is a syslog-based format that normalizes logs from different security products, making them easier to parse and analyze in Sentinel. Both connectors allow on-premises firewalls to forward their logs to a Log Analytics agent or AMA, which then sends them to Sentinel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DNS
Why it's wrong here
The DNS connector is specifically designed to ingest DNS query and response logs from Windows DNS servers, not generic firewall traffic or security logs. Firewalls typically generate connection, policy, and threat logs that have no DNS-specific schema, so this connector would not capture or parse the relevant data for security monitoring.
- ✓
Syslog
Why this is correct
Syslog is a ubiquitous standard protocol (RFC 5424) supported by virtually all enterprise firewalls, including Palo Alto, Fortinet, Cisco ASA, and Check Point. The Microsoft Sentinel Syslog connector collects these raw syslog messages and normalizes them for detection and investigation, making it the correct and most flexible choice for ingesting firewall logs.
- ✓
Common Event Format (CEF)
Why this is correct
Common Event Format (CEF) is an extensible, key-value log format widely adopted by security devices like firewalls and intrusion prevention systems. Sentinel's CEF connector ingests and automatically parses these events into the CommonSecurityLog table, enabling advanced analytics; therefore, it is also a valid connector for firewall logs, particularly when the firewall vendor supports CEF output.
- ✗
Azure Activity Log
Why it's wrong here
The Azure Activity Log captures subscription-level events known as the control plane, such as creating or deleting Azure resources through Azure Resource Manager. It does not integrate with on-premises infrastructure or network firewalls, and it cannot receive logs from non-Azure devices, so it is entirely unsuitable for third-party firewall log ingestion.
- ✗
Windows Security Events via AMA
Why it's wrong here
The Windows Security Events connector via Azure Monitor Agent (AMA) collects security audit events from the Windows Event Log on Windows servers and clients, such as logon attempts and process creation. It does not gather network traffic or firewall log data, and network firewalls are separate appliances that do not emit Windows event logs, so this connector cannot be used for that purpose.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 212-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.