Exam SC-500 Topic 1 Question 18 Discussion

Actual exam question for Microsoft's SC-500 exam
Question #: 18
Topic #: 1
You have a Microsoft Sentinel workspace named Workspace1.
You have 100 on-premises servers that run Linux and have the Azure Monitor Agent installed.
You need to collect Syslog events from the Linux servers. The solution must meet the following requirements:
- Ensure that filtering occurs before data is written to Workspace1.
- Reduce ingestion costs by excluding low-value Syslog messages.
What should you include in the solution?

Suggested Answer: B Vote an answer

A data collection rule defines the Syslog facilities and severity levels that the Azure Monitor Agent collects from the Linux servers and sends to Workspace1. By excluding low-value messages in the rule, unwanted events are filtered before storage in the Log Analytics workspace, reducing data ingestion costs.
Reference:
https://learn.microsoft.com/en-us/azure/azure-monitor/vm/data-collection-syslog
https://learn.microsoft.com/en-us/azure/sentinel/connect-cef-syslog-ama?tabs=portal

by Hannah at Jul 16, 2026, 01:00 AM

Limited Time Offer

15%

Off

Get Premium SC-500 Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10