SC-200 Practice Question: Match each Microsoft Sentinel data connector on…

Match each Microsoft Sentinel data connector on the left with the table name it populates on the right.

⚠ Common exam trap

Test-takers frequently confuse the CommonSecurityLog table with the Syslog table, but Cisco ASA via Syslog specifically populates CommonSecurityLog (not Syslog) because Sentinel normalizes syslog data from security appliances into a common schema for easier correlation.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Microsoft Entra ID → SigninLogs; Windows Security Events via AMA → SecurityEvent; Cisco ASA via Syslog → CommonSecurityLog; Azure Activity → AzureActivity

It accurately maps each Microsoft Sentinel data connector to its corresponding log table. Microsoft Entra ID populates the SigninLogs table, Windows Security Events via AMA populates the SecurityEvent table, Cisco ASA via Syslog populates the CommonSecurityLog table (which is the standard schema for syslog-based security appliances), and Azure Activity populates the AzureActivity table. These mappings are defined by the data connectors themselves and are fundamental to querying the correct data in Sentinel.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Microsoft Entra ID → SigninLogs; Windows Security Events via AMA → SecurityEvent; Cisco ASA via Syslog → CommonSecurityLog; Azure Activity → AzureActivity
Why this is correct
This is the correct mapping based on the documented function of each item.
✗
The first and last mappings are swapped.
Why it's wrong here
Those items serve different purposes, so the swapped mapping is incorrect.
✗
Every item maps to the same log table or feature category.
Why it's wrong here
The items populate or represent different tables/features.
✗
Only identity-related items are mapped; workload and network items are omitted.
Why it's wrong here
A complete mapping must include every listed item.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Last reviewed: Jun 11, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

Keep practising

Question 1,598 of 1,038

Next question

Scored practice sessions

Short scored sets — answer, get feedback, read the explanation, move on.

Free SC-200 Practice Test 3 — 30 Questions→SC-200 Practice Test 5 — 25 Questions→

Study by exam domain

Drill one exam section at a time instead of jumping between unrelated topics.

Manage a security operations environment Respond to security incidents Perform threat hunting

Practice by question type

Pick a question style and work only that format until it feels routine.

Browse scenarios

Practice by topic

One concept per page — questions, worked explanations, and a short concept guide.

SC-200 fundamentals practice questions Respond to security incidents practice questions Manage a security operations environment practice questions SC-200 scenario practice questions

Keep going

Study guide SC-200 practice test All SC-200 questions

This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.