easyMultiple ChoiceObjective-mapped
SC-200 Practice Question: Has connected a Palo Alto Networks firewall to…
An organization has connected a Palo Alto Networks firewall to Microsoft Sentinel using the Common Event Format (CEF) connector via a Linux log forwarder. The analyst notices that some expected firewall logs are missing in Sentinel. Which troubleshooting step should be performed first to check if the logs are reaching the Sentinel workspace?
⚠ Common exam trap
The trap here is that candidates often jump to checking the source (firewall) or network connectivity first, but Microsoft Sentinel expects you to start by verifying data ingestion at the workspace level using KQL, as this immediately confirms whether the entire pipeline is working or broken.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run a KQL query in the Sentinel Logs workspace: CommonSecurityLog | where TimeGenerated > ago(1h) | take 10
The first step in troubleshooting missing logs in Microsoft Sentinel is to verify whether the logs are actually reaching the workspace. Running a KQL query against the CommonSecurityLog table (which stores CEF data) with a recent time filter confirms if any CEF logs have been ingested. If the query returns results, the issue lies elsewhere (e.g., parsing or missing events); if it returns no results, the problem is upstream (connector, forwarder, or source). This step isolates the problem to the Sentinel ingestion pipeline before investigating network or configuration issues.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run a KQL query in the Sentinel Logs workspace: CommonSecurityLog | where TimeGenerated > ago(1h) | take 10
Why this is correct
Querying CommonSecurityLog with a simple KQL filter for the last hour directly verifies whether Palo Alto CEF messages have been parsed and ingested into the Log Analytics workspace that backs Sentinel. Because CommonSecurityLog is the target schema for third-party syslog/CEF sources, seeing any rows proves the full pipeline (firewall, forwarder, agent, workspace) is functionally delivering data, making this the correct confirmatory test.
- ✗
Check the firewall configuration to ensure syslog forwarding is enabled and pointing to the correct Linux forwarder
Why it's wrong here
Checking the firewall's syslog forwarder settings validates configuration on the Palo Alto device itself, but does not confirm that data has actually reached the Log Analytics workspace; logs could be misconfigured, blocked by a network ACL, or mishandled by the agent. This step is only meaningful after negative evidence from the Sentinel query, making it a secondary troubleshooting action rather than a verification of workspace ingestion.
- ✗
Verify network connectivity between the firewall and the Linux forwarder on port 514 (or the configured port)
Why it's wrong here
Verifying network connectivity between the firewall and the Linux forwarder on port 514 checks only that raw CEF syslog messages can reach the forwarder, but the question asks whether logs are reaching the *Sentinel workspace*. Logs could arrive at the forwarder yet still be lost during parsing, agent forwarding, or ingestion into the Log Analytics workspace. This step is tempting because port-514 connectivity is the first prerequisite for any syslog-based ingestion; in a scenario where no logs appear at the forwarder at all, it would be the correct initial check.
- ✗
Restart the Log Analytics agent on the Linux forwarder
Why it's wrong here
Restarting the Log Analytics agent is a disruptive, last-resort action that may clear a transient agent hang but does not provide diagnostic evidence about whether logs are arriving at Sentinel; it also risks dropping buffered data or interrupting forwarding for all log sources. Since the question asks whether logs are reaching the workspace, the correct approach is to inspect the CommonSecurityLog table first, then methodically test each pipeline component before resorting to a restart.
Go deeper
Related to this question
About these practice questions
One of 673 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.