SC-200 Manage a security operations environment Practice Question
You are configuring Microsoft Sentinel to ingest logs from a third-party firewall via Syslog. The data connector shows 'Connected' but no events are being received. You have verified network connectivity and firewall configuration. What should you check next?
⚠ Common exam trap
Many candidates assume 'Connected' means data is flowing, but in Syslog connectors, 'Connected' only indicates the agent can reach the Log Analytics workspace—the DCR's filtering logic is the hidden gate that stops events from being ingested.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Validate that the Data Collection Rule (DCR) is properly configured to ingest the Syslog facility and severity.
When a Syslog data connector shows 'Connected' but no events are received, the most common cause is a misconfigured Data Collection Rule (DCR). The DCR defines which Syslog facilities and severities to collect; if it does not match the firewall's actual Syslog output (e.g., facility 'local0' with severity 'informational'), events will be filtered out before ingestion. Network connectivity and firewall configuration are already verified, so the DCR is the next logical check.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Validate that the Data Collection Rule (DCR) is properly configured to ingest the Syslog facility and severity.
Why this is correct
The Data Collection Rule (DCR) is the authoritative configuration that maps Syslog facility and severity filters to the Log Analytics workspace table. If the DCR's filters are too restrictive, omit the expected facility, or the DCR isn't correctly linked to the Azure Monitor Agent (AMA) and Data Collection Endpoint (DCE), events will be silently dropped. Validating the DCR is the first diagnostic step because misconfigurations here are the most common cause of missing Syslog ingestion.
- ✗
Verify that the connector has the necessary OAuth permissions in Microsoft Entra ID.
Why it's wrong here
Syslog ingestion through the Azure Monitor Agent (AMA) authenticates to the Data Collection Endpoint using the agent's managed identity or the workspace key, not via Microsoft Entra ID OAuth tokens. The Syslog connector does not have an OAuth permission model, unlike Office 365 or Azure AD connectors that rely on Entra ID. Therefore, checking OAuth permissions is irrelevant and will not reveal why Syslog data is absent.
- ✗
Check that the user who configured the connector has the Microsoft Sentinel Contributor role.
Why it's wrong here
The Microsoft Sentinel Contributor role grants permissions to install and configure data connectors, but it does not control the runtime ingestion path once the connector and DCR are deployed. After configuration, the Azure Monitor Agent forwards Syslog data to Log Analytics independent of the configuring user's role. Thus, the absence of events would not be caused by this role, although it is needed for the initial setup.
- ✗
Ensure the firewall is registered in Azure Policy as a compliant resource.
Why it's wrong here
Azure Policy is a governance service for enforcing compliance rules on Azure resources, but it has no role in the Syslog data flow from the network device to the Azure Monitor Agent and Log Analytics. Syslog ingestion does not require the firewall to be registered as compliant, and policy assignments do not block or modify log forwarding. Checking Azure Policy compliance is therefore unrelated to diagnosing missing Syslog events.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 673 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are configuring Microsoft Sentinel to ingest logs from a third-party firewall via Syslog. After configuring the data connector, you notice that no logs are appearing. You verify that the firewall is sending logs to the Syslog collector. What is the most likely cause?
easy- A.The firewall is sending logs in a format incompatible with the Azure Monitor Agent.
- B.The ingestion cost is too high and Sentinel throttled the connection.
- ✓ C.The syslog daemon on the collector is not configured to forward logs to the Log Analytics workspace.
- D.The data connector is disabled in the Log Analytics workspace.
Why C: The most common reason logs fail to appear in Microsoft Sentinel after configuring a Syslog data connector is that the Syslog daemon (e.g., rsyslog or syslog-ng) on the collector VM is not configured to forward logs to the Log Analytics workspace. Even if the firewall sends logs to the collector, the Azure Monitor Agent (AMA) or legacy Log Analytics agent relies on the local Syslog daemon to listen on UDP port 514 (or TCP 6514) and forward those events to the agent, which then sends them to the workspace. Without proper daemon configuration (e.g., adding rules in /etc/rsyslog.d/ to forward facility/severity levels), the agent never receives the logs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.