SC-200 Manage a security operations environment Practice Question
Your organization has multiple offices across the globe and uses Microsoft Sentinel as the primary SIEM. You have deployed Azure Arc on all on-premises servers to manage them centrally. The security team needs to collect Windows Security Events from all servers, including domain controllers, and forward them to Sentinel using the Windows Security Events via AMA connector. The team also wants to minimize administrative overhead when adding new servers. The current environment includes: 500 on-premises Windows servers (200 domain controllers, 300 member servers) managed via Azure Arc, 200 Azure VMs running Windows Server, and a centralized Log Analytics workspace named 'LAW-Security' in the East US region. You have already installed the Azure Monitor Agent (AMA) on all servers via Azure Arc and Azure VMs. However, you notice that security events from domain controllers are not appearing in Sentinel. You have verified that the AMA agent is running and the data collection rule (DCR) is correctly configured to collect Security events. No other issues are present. You need to ensure that security events from domain controllers are collected. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the network connectivity from the domain controllers to the Log Analytics workspace endpoint. Ensure that the domain controllers can reach the required URLs.
Domain controllers often have more restrictive network policies, and they must be able to reach the Log Analytics workspace endpoint (the data collection endpoint and the Log Analytics service) to send events. The AMA agent is running and the DCR is configured, but if domain controllers cannot connect to the required URLs (e.g., *.ods.opinsights.azure.com, *.oms.opinsights.azure.com, etc.), events will not be collected. Option A is incorrect because the connector configuration is not the issue; the connector is already working for other servers. Option B is incorrect because restarting the agent does not address network issues. Option C is incorrect because the DCR namespace is irrelevant; the DCR configuration is correct for other servers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reinstall the Windows Security Events via AMA connector in Sentinel.
Why it's wrong here
The connector is a data source configuration; reinstalling won't fix connectivity.
- ✗
Restart the Azure Monitor Agent on all domain controllers.
Why it's wrong here
Restarting is not likely to resolve a connectivity issue.
- ✗
Recreate the data collection rule with a different namespace.
Why it's wrong here
The DCR is correct; no need to recreate.
- ✓
Check the network connectivity from the domain controllers to the Log Analytics workspace endpoint. Ensure that the domain controllers can reach the required URLs.
Why this is correct
Domain controllers may have firewall rules that block outbound connectivity to Azure endpoints. The AMA agent needs to send data to the workspace.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 673-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.