mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC analyst needs to ingest firewall logs from…
A SOC analyst needs to ingest firewall logs from an on-premises Cisco ASA into Microsoft Sentinel. The logs are sent via syslog to a Linux server. Which data connector should the analyst use to properly parse and collect these logs?
⚠ Common exam trap
The trap here is that candidates see 'syslog' in the question and immediately choose the Syslog connector, not realizing that Cisco ASA logs are best ingested via the CEF connector to leverage automatic parsing into structured fields, whereas raw Syslog would require heavy KQL parsing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Common Event Format (CEF)
The Common Event Format (CEF) connector is the correct choice because Cisco ASA firewalls send syslog messages that can be forwarded to a Linux log collector (rsyslog or syslog-ng), which then formats them into CEF (a normalized syslog format) before forwarding to the Sentinel Log Analytics workspace. This connector parses the CEF headers and maps the fields into the CommonSecurityLog table, enabling proper parsing and correlation of firewall events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Common Event Format (CEF)
Why this is correct
Common Event Format (CEF) is a Syslog-based logging standard widely used by network and security appliances, and Microsoft Sentinel provides a dedicated CEF connector that automatically parses its key-value fields into the CommonSecurityLog schema. For Cisco ASA, you configure the appliance to send CEF-formatted events to the Log Analytics agent or Azure Monitor Agent, which then enriches and normalizes the data for queries and analytics. This is the correct choice because it gives structured, schema-mapped data with minimal configuration in Sentinel.
- ✗
Syslog
Why it's wrong here
The generic Syslog connector in Microsoft Sentinel collects raw syslog messages well, but it deposits them largely as free-form text in the Syslog table rather than extracting and normalizing CEF-specific fields into dedicated columns. If you pointed a Cisco ASA at only a generic Syslog destination, you would lose the automatic parsing, event type classification, and field mapping that the CEF connector provides. CEF is therefore the recommended, structured alternative even though the underlying transport for both is UDP/TCP syslog.
- ✗
Windows Firewall
Why it's wrong here
The Windows Firewall connector is designed specifically for the Windows Defender Firewall logs and Windows Filtering Platform events that are generated by Windows machines, not for third-party network appliances. Cisco ASA is a hardware-based firewall appliance running Cisco IOS, and its logs are not written to the Windows event channel. Because there is no Windows event log to collect, this connector is irrelevant for ingesting on-premises Cisco ASA firewall logs into Sentinel.
- ✗
Cisco ASA via API
Why it's wrong here
There is no Cisco ASA via API data connector available in Microsoft Sentinel, and the officially supported method for collecting ASA logs is the CEF connector over Syslog. While newer Cisco ASA/FTD devices expose a REST API, Sentinel does not include a native connector that leverages that API for log ingestion, and building a custom API-based solution would be unnecessary and overly complex. CEF remains the straightforward, built-in, and well-documented path for these logs.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.