SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company wants to use Microsoft Sentinel to collect security logs from on-premises servers and send them to Azure. Which data connector should they use?
⚠ Common exam trap
Test-takers frequently confuse the Syslog connector (Option B) as the correct answer for on-premises Linux servers, but the question specifically asks for a data connector that directly collects logs from on-premises servers, and AMA is the modern, unified agent that handles both Windows and Linux without requiring an intermediate Syslog forwarder.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Monitor Agent (AMA)
The Azure Monitor Agent (AMA) is the correct choice because it is the current, unified data collection agent for Microsoft Sentinel that supports collecting security logs from Windows and Linux on-premises servers. It replaces the legacy Microsoft Monitoring Agent (MMA) and provides a more secure, scalable, and performant method to send logs to Azure Log Analytics workspaces, which underpin Sentinel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Monitor Agent (AMA)
Why this is correct
The Azure Monitor Agent (AMA) is the correct and recommended solution for collecting security logs from both Windows and Linux servers, including on-premises, for ingestion into Microsoft Sentinel. It offers a more secure, efficient, and flexible data collection experience compared to its predecessor, allowing granular control over which logs are collected via Data Collection Rules (DCRs). AMA supports a wide range of log types, including security events, performance counters, and Syslog, making it ideal for comprehensive security monitoring.
- ✗
Syslog connector
Why it's wrong here
While Syslog is a standard protocol for collecting event logs from Linux systems, selecting a standalone "Syslog connector" is not the most comprehensive or recommended approach for Microsoft Sentinel. The Azure Monitor Agent (AMA) can efficiently collect Syslog data from Linux servers, alongside other critical security logs, using a unified agent and Data Collection Rules. Relying solely on a generic Syslog connector would miss the broader capabilities and centralized management offered by AMA for diverse server log collection.
- ✗
Microsoft Monitoring Agent (MMA)
Why it's wrong here
The Microsoft Monitoring Agent (MMA), also known as the Log Analytics agent, is an outdated solution for collecting logs and is actively being deprecated by Microsoft. While it previously served to ingest data into Log Analytics workspaces, it lacks the advanced features, efficiency, and granular control provided by the Azure Monitor Agent (AMA). Organizations should transition from MMA to AMA for all new deployments and existing server log collection to ensure continued support and access to modern capabilities.
- ✗
Office 365 connector
Why it's wrong here
The Office 365 connector in Microsoft Sentinel is specifically designed to ingest audit logs and activity data from various Microsoft 365 services, such as Exchange Online, SharePoint Online, and Azure Active Directory. This connector is entirely focused on cloud-based productivity and identity services, not on collecting security event logs directly from on-premises or cloud-hosted servers. Therefore, it is unsuitable for the stated requirement of collecting security logs from servers.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Microsoft Sentinel
Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration automation and response (SOAR) service that helps organizations detect, investigate, and respond to cyber threats across their entire digital estate.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.