SC-100 Practice Question: Design security operations, identity, and compliance capabilities
A company uses Microsoft Sentinel and wants to use a built-in connector to ingest logs from Amazon Web Services (AWS). Which connector should they use?
⚠ Common exam trap
Many exam-takers confuse Azure Policy for AWS (which is a governance tool, not a log ingestion connector) with a valid data source, or assume that a generic connector like ServiceNow could be adapted for AWS log ingestion, when only the AWS S3 connector is the built-in, purpose-built option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon Web Services S3 connector
The Amazon Web Services (AWS) S3 connector is the correct built-in connector in Microsoft Sentinel for ingesting logs from AWS. It works by configuring AWS to send logs (such as CloudTrail, VPC Flow Logs, or GuardDuty findings) to an S3 bucket, which Sentinel then polls via the S3 REST API using an IAM role for secure, cross-account access. This is the native, supported method for log ingestion from AWS into Sentinel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ServiceNow connector
Why it's wrong here
The ServiceNow connector is designed to integrate Sentinel with the ServiceNow ITSM platform, allowing security incidents to be exported as tickets for workflow management and tracking. It does not ingest external cloud logs; it only bi-directionally syncs incident data between Sentinel and ServiceNow. Consequently, it has no capability to collect or normalize AWS CloudTrail data from S3, making it irrelevant to the requirement of bringing AWS logs into Sentinel.
- ✗
Azure Policy for AWS
Why it's wrong here
Azure Policy for AWS uses Azure Arc to extend policy evaluation to AWS resources, but it is an Azure governance tool, not a data connector. Policies can identify non-compliant resources in AWS, but they neither ingest logs into Sentinel nor forward raw event data for analytics. Therefore, it cannot serve as the built-in data collection mechanism for AWS logs in Sentinel, as it lacks the ingestion pipeline that the S3 connector provides.
- ✗
Office 365 connector
Why it's wrong here
The Office 365 connector is a built-in Sentinel data connector that ingests only Microsoft 365 workload logs, such as Exchange Online, SharePoint, Teams, and Microsoft 365 Defender alerts. Its data sources are exclusively within the Microsoft 365 suite and it has no integration path for AWS-native logs like CloudTrail. Selecting it would provide zero visibility into AWS activity, so it is an incorrect choice for collecting AWS logs.
- ✓
Amazon Web Services S3 connector
Why this is correct
The Amazon Web Services S3 connector is the built-in Microsoft Sentinel connector for AWS, ingesting CloudTrail management events (and optionally data events) via logs stored in an S3 bucket. It uses an SQS queue to notify Sentinel of new log files, and an Azure Function runs to pull them into the Log Analytics workspace. This is the standard, supported method for continuous AWS log ingestion, making it the correct option.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 605 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.