Quick Answer
The answer is that UEBA must be enabled in the Sentinel settings, and Windows Security Events must be ingested via the Azure Monitor Agent (AMA). UEBA requires this specific data source because it relies on raw security events like logon attempts and process creation to establish behavioral baselines and detect anomalies; without these events, the analytics engine has no user or entity activity to profile. On the SC-200 exam, this question tests your understanding that UEBA is not automatic—it must be toggled on in the configuration blade, and the AMA is the modern, required agent for feeding the necessary event IDs. A common trap is assuming Azure Activity Logs or Office 365 data alone suffice, but they lack the granular system-level events UEBA needs. Remember the memory tip: “AMA logs for UEBA baselines”—if you see AMA and enabled settings, you have the two prerequisites.
This SC-200 practice question tests your understanding of manage a security operations environment. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO of the following are required to enable user and entity behavior analytics (UEBA) in Microsoft Sentinel?
Microsoft Entra ID diagnostic logs must be streamed.
Why wrong: Not required for UEBA.
Azure subscription diagnostic logs must be enabled.
Why wrong: Not required.
Windows Security Events via AMA must be ingested.
Required for entity enrichment.
Microsoft Defender XDR connector must be configured.
Why wrong: Not required.
UEBA must be enabled in the Sentinel settings.
UEBA must be turned on.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Windows Security Events via AMA must be ingested.
Option C is correct because Windows Security Events ingested via the Azure Monitor Agent (AMA) provide the necessary user and entity activity data (e.g., logon events, process creation) that UEBA analyzes to establish behavioral baselines and detect anomalies. Without this data source, UEBA lacks the raw security events required for user and entity profiling.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Microsoft Entra ID diagnostic logs must be streamed.
Why it's wrong here
Not required for UEBA.
Azure subscription diagnostic logs must be enabled.
Why it's wrong here
Not required.
Windows Security Events via AMA must be ingested.
Why this is correct
Required for entity enrichment.
Related concept
Read the scenario before looking for a memorised answer.
Microsoft Defender XDR connector must be configured.
Why it's wrong here
Not required.
UEBA must be enabled in the Sentinel settings.
Why this is correct
UEBA must be turned on.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
The trap here is that candidates assume UEBA requires premium connectors like Microsoft Defender XDR or Entra ID diagnostic logs, when in fact the core requirement is enabling UEBA in settings and ingesting a supported data source such as Windows Security Events via AMA.
Detailed technical explanation
UEBA in Microsoft Sentinel leverages machine learning models to analyze historical and real-time data from sources like Windows Security Events (via AMA), which include Event ID 4624 (logon) and 4688 (process creation). The feature requires explicit enablement in Sentinel settings under 'Entity behavior analytics' to activate the anomaly detection pipelines. In practice, organizations often combine UEBA with Microsoft Entra ID logs for richer identity context, but the core requirement is the ingestion of security events that capture user and entity actions.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Manage a security operations environment — study guide chapter
Learn the concepts, then practise the questions
Manage a security operations environment practice questions
Targeted practice on this topic area only
All SC-200 questions
1,639 questions across all exam domains
Microsoft Security Operations Analyst SC-200 study guide
Full concept coverage aligned to exam objectives
SC-200 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SC-200 questions linked to Manage a security operations environment.
Practise SC-200 questions linked to Respond to security incidents.
Practise SC-200 questions linked to Perform threat hunting.
Practise SC-200 questions linked to Mitigate threats using Microsoft Defender XDR.
Practise SC-200 questions linked to Mitigate threats using Microsoft Defender for Cloud.
Practise SC-200 questions linked to Mitigate threats using Microsoft Sentinel.
Practise SC-200 questions linked to SC-200 fundamentals.
Practise SC-200 questions linked to SC-200 scenario.
Practise SC-200 questions linked to SC-200 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Manage a security operations environment — This question tests Manage a security operations environment — Read the scenario before looking for a memorised answer..
The correct answer is: Windows Security Events via AMA must be ingested. — Option C is correct because Windows Security Events ingested via the Azure Monitor Agent (AMA) provide the necessary user and entity activity data (e.g., logon events, process creation) that UEBA analyzes to establish behavioral baselines and detect anomalies. Without this data source, UEBA lacks the raw security events required for user and entity profiling.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 25, 2026
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.