SC-200 Practice Question: A SOC analyst needs to create a basic analytics…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Azure Activity log (AzureActivity)

  Why this is correct

  The AzureActivity table is populated by the Azure Activity connector and captures control-plane operations, such as Microsoft.Compute/virtualMachines/write for VM creation. A basic analytics rule can query AzureActivity for these operations to detect when a VM is provisioned, which is a common precursor to opening management ports. This makes it the correct and direct data source for detecting the resource creation event itself.

• ✗

  Azure Security Center alerts (SecurityAlert)

  Why it's wrong here

  The SecurityAlert table ingests security alerts generated by Microsoft Defender for Cloud, such as detected malware or suspicious sign-in activity. These alerts are post-detection findings from security analytics, not raw Azure resource creation events like VM writes or NSG changes. Using SecurityAlert would only tell you that some security tool flagged an issue, not that a VM was created and its management port opened—so it cannot directly detect the control-plane action.

• ✗

  Microsoft Entra ID Audit logs (AuditLogs)

  Why it's wrong here

  The AuditLogs table in Microsoft Sentinel is populated from Microsoft Entra ID audit logs, capturing identity-related events such as user sign-ins, conditional access outcomes, and directory role changes. It does not include Azure resource provisioning or configuration operations like creating a VM or modifying a network security group, so it would never contain the event that opens a management port. While identity audits can show who performed an action, they lack the resource-level details needed for this detection.

• ✗

  Azure Network Watcher logs (NetworkMonitoring)

  Why it's wrong here

  The NetworkMonitoring table is part of the Azure Network Watcher solution and stores network health data, including connection monitor results, packet captures, and NSG flow logs. It does not record control-plane resource creation events, so it cannot reveal when a VM was provisioned with an exposed management port. Even if the network traffic later shows port access, the NetworkMonitoring table only reflects the resulting state after the resource already exists, not the originating provisioning action.

Go deeper

Related to this question