SC-200 Practice Question: A security analyst needs to connect a Palo Alto…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Palo Alto Networks (via Syslog CEF)

  Why this is correct

  The Palo Alto Networks (via Syslog CEF) connector is the vendor-specific data connector in Microsoft Sentinel that ingests Palo Alto firewall logs formatted as Common Event Format (CEF) over Syslog. It automatically applies the Sentinel CEF parser to map fields into the CommonSecurityLog schema, preserving predefined field mappings, timestamp normalization, and severity enrichment without requiring custom KQL. Because Palo Alto is a validated CEF device, using its dedicated connector is the supported, out-of-the-box path that ensures analytics rules and UEBA features work immediately.

• ✗

  Common Event Format (CEF) via Syslog (generic)

  Why it's wrong here

  Common Event Format (CEF) via Syslog (generic) is incorrect because, whilst Palo Alto firewalls output CEF, this generic connector lacks the pre-built parsing and normalisation schema specifically for Palo Alto Networks firewall events within Microsoft Sentinel. It would ingest raw CEF, requiring significant custom KQL to make the data actionable. This option is tempting as it uses supported protocols, and it is the correct choice for ingesting CEF logs from sources that do not have a dedicated Sentinel data connector, providing a flexible ingestion point for custom log types.

• ✗

  Syslog (without CEF)

  Why it's wrong here

  Syslog without CEF lacks the predefined field mappings and timestamp normalisation that Microsoft Sentinel’s Common Event Format parser applies, so Palo Alto Networks firewall logs would arrive as raw, unstructured syslog messages, forcing the analyst to write custom parsing rules and losing the automatic schema alignment that CEF provides. This option is tempting because many network devices natively emit syslog, and in scenarios where a device does not support CEF or where the analyst intends to build a bespoke ingestion pipeline, plain syslog is the correct connector.

• ✗

  Custom Text Logs

  Why it's wrong here

  Custom Text Logs are designed for ingesting arbitrary, non-standard log files via a custom log table that the analyst must manually define and parse in the Log Analytics workspace. Choosing this option for Palo Alto CEF syslog messages would treat each event as an opaque raw string, discarding the structured CEF header and key-value extensions that the built-in CEF parser would otherwise extract. This forces the analyst to write custom parsing rules for every field, reinventing the CommonSecurityLog normalization and losing the out-of-the-box anomaly detections and entity mappings that rely on that schema.

Go deeper

Related to this question