mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC team uses Microsoft Sentinel and wants to…
A SOC team uses Microsoft Sentinel and wants to ingest custom log events from an on-premises Linux application that writes to a local file. The team sets up the Log Analytics agent on the Linux server and configures a data connector. Which of the following is the necessary configuration step to collect the custom log file?
⚠ Common exam trap
Many candidates confuse syslog data connectors with custom log file collection, assuming any Linux log file can be ingested via syslog, when in fact syslog only handles logs sent to the syslog daemon, not arbitrary application files.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Custom Logs feature in the Log Analytics workspace to specify the path to the application log file and define the log type name.
The Custom Logs feature in the Log Analytics workspace is specifically designed to ingest text-based log files from on-premises Linux servers via the Log Analytics agent. You must specify the exact file path (e.g., /var/log/myapp.log) and define a custom log type name (e.g., MyApp_CL) to parse the file and send the data to a custom table in the Log Analytics workspace. This is the only method that directly collects custom application log files without requiring syslog or API-based ingestion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Syslog data connector and specify the facility and severity to filter the application logs from /var/log.
Why it's wrong here
The Syslog data connector in Microsoft Sentinel ingests messages that the syslog daemon (rsyslog/syslog-ng) forwards, typically over UDP or TCP port 514. It does not monitor arbitrary application log files at paths like /var/log; the agent only reads the system's syslog stream. Configuring facility and severity filters narrows the stream but won't capture a file the application writes directly unless the application also logs via syslog. Moreover, syslog messages follow RFC 3164/5424 formatting, while your application's file may have a different structure, so this connector is the wrong tool.
- ✗
Configure the Log Analytics agent to collect performance counters for the application process.
Why it's wrong here
Performance counters collect numeric system or process metrics such as CPU usage, memory utilization, and disk I/O on a sampling interval. These values are stored as metric-like data in the Log Analytics workspace, not as text log entries. Even if you enable performance counters for the application process, you would only get snapshots like '% Processor Time' or 'Private Bytes', not the actual content of the log lines written to the file. Therefore, this approach cannot ingest the custom application log file at all.
- ✓
Use the Custom Logs feature in the Log Analytics workspace to specify the path to the application log file and define the log type name.
Why this is correct
Using the Custom Logs feature in the Log Analytics workspace is the correct method for ingesting text-based application logs from a local file. In the workspace, you create a custom log by specifying the file path, assigning a log type name (e.g., AppLogs_CL), and providing a sample log file so the agent can determine the format. The Log Analytics agent then continuously tails the specified file and forwards each new line as a record into that custom table. This approach requires no modification to the application because the agent handles file monitoring directly.
- ✗
Deploy a Log Analytics gateway and configure the application to write directly to the gateway using the HTTP Data Collector API.
Why it's wrong here
A Log Analytics gateway is a proxy component that forwards data from installed agents to Azure Monitor for environments with limited internet connectivity; it is not a syslog server or an HTTP endpoint that receives writes from arbitrary applications. The HTTP Data Collector API is a REST endpoint that applications can use to push custom logs, but deploying it would require rewriting the application to send HTTP requests to that API. Since the scenario states the application writes to a local file, a gateway plus API approach neither reads that file nor avoids application changes. You would still need an agent to tail the file, making the Custom Logs feature the appropriate solution.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.