MENU
You have an Azure subscription that has Azure Defender enabled for all supported resource types.
You need to configure the continuous export of high-severity alerts to enable their retrieval from a third-party security information and event management (SIEM) solution.
To which service should you export the alerts?
Suggested Answer: C
Get Premium SC-200 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
30 comments · newest first
RO
Roosevelt
6 months ago
I agree with Event Hubs. It’s perfect for integrating with SIEM solutions.
WA
Wade
6 months ago
Azure Data Lake seems more for storage, not real-time alerts.
JE
Jerlene
7 months ago
Azure Event Hubs makes sense for continuous export. High-severity alerts need scalability.
MA
Maile
7 months ago
I feel like Azure Cosmos DB is not the right fit for alerts.
LE
Lettie
7 months ago
I’m leaning towards Azure Event Grid. It’s event-driven.
EL
Elin
7 months ago
I think it’s Azure Event Hubs. It’s designed for big data scenarios.
CO
Coletta
7 months ago
Surprised this isn't more straightforward! Why not just use Cosmos DB?
AL
Alishia
8 months ago
I thought Data Lake could work, but Event Hubs makes more sense.
AN
Annice
8 months ago
Wait, are we sure it's not Event Grid? Seems like a good option too.
MA
Maryann
8 months ago
Definitely agree with that! Event Hubs is the way to go.
DA
Dana
8 months ago
C) Azure Event Hubs, no doubt about it. Anything else would be like trying to use a spoon to dig a hole. Just doesn't make sense.
JA
Jacqueline
9 months ago
Hmm, I'm going with C) Azure Event Hubs. It's the most logical option for this use case. Anything else would just be a waste of time and resources.
BE
Bev
9 months ago
C) Azure Event Hubs is the obvious choice here. Anything else would be like trying to fit a square peg in a round hole.
RO
Rodolfo
9 months ago
I agree, Azure Event Hubs is the way to go. It's designed for high-throughput, real-time data ingestion, which is exactly what you need for alert exports.
SO
Sommer
9 months ago
I’m leaning towards Azure Event Hubs too, but I wonder if there’s a specific reason we wouldn’t use Azure Cosmos DB for this?
ST
Stephaine
9 months ago
I practiced a similar question, and I feel like Azure Data Lake is more for storage rather than real-time alerts.
ON
Oneida
9 months ago
I’m not entirely sure, but I remember something about Azure Event Grid being used for event routing. Could that be it?
DI
Diane
10 months ago
I think we might need to export to Azure Event Hubs since it’s designed for high-throughput data streaming.
ME
Melvin
10 months ago
I'm a bit confused on this one. Is Azure Event Grid also an option for exporting alerts? I'll have to think through the differences between the services to decide.
AN
Annice
10 months ago
I think it's Azure Event Hubs for exporting alerts.
NG
Nguyet
10 months ago
Okay, I've got this. Azure Event Hubs is designed for high-volume data ingestion, which is perfect for sending alerts to a SIEM. I'm confident that's the right answer.
VA
Vannessa
11 months ago
The key here is that we need to export the alerts to enable retrieval by a third-party SIEM solution. Based on that, I'm leaning towards C) Azure Event Hubs as the best choice.
AN
Annelle
11 months ago
C) Azure Event Hubs is the correct answer. It's the perfect service to export high-severity alerts for integration with a SIEM solution.
RY
Ryan
11 months ago
Hmm, I'm not sure about this one. I'll need to review the Azure Defender documentation again to make sure I understand the options for exporting alerts.
CE
Cecilia
11 months ago
I think the answer is C) Azure Event Hubs. That seems like the most logical choice for exporting alerts to a SIEM solution.
SU
Susana
6 months ago
C is the way to go for integration with SIEMs!
DI
Dick
6 months ago
I was leaning towards that too, good choice!
CA
Carlee
6 months ago
Definitely, Event Hubs can handle high volumes of alerts.
DO
Dottie
6 months ago
Yeah, it’s designed for real-time data streaming.
AR
Arlene
10 months ago
I agree, C) Azure Event Hubs makes sense for that.