AZ-500 Question 265
Single answerYour company uses multiple on-premises network devices that generate logs in the Common Event Format (CEF). You need to ingest these logs into Microsoft Sentinel for centralized monitoring and correlation. Which of the following approaches best ensures that Microsoft Sentinel automatically detects and parses the CEF logs from these devices?
- A
Install the Log Analytics or Azure Monitor agent on a dedicated Linux server, configure Syslog to receive CEF logs from the devices, and enable the CEF connector in Microsoft Sentinel.
- B
Use the Azure Active Directory (Azure AD) connector to directly collect the CEF logs from on-premises devices into Microsoft Sentinel.
- C
Configure each device to send logs over HTTPS directly to the Sentinel workspace using port 443 without any intermediate server or connector.
- D
Deploy the Log Analytics agent on each device generating CEF logs and forward them directly to the Sentinel workspace.
Show answer and explanation
Correct answer: A
Explanation
To ingest CEF logs into Microsoft Sentinel, a common best practice is to deploy a Linux server that has either the Azure Monitor or Log Analytics agent installed. This server acts as a Syslog collector, receiving forwarded CEF logs from on-premises devices. Once configured, you enable the CEF connector in Sentinel to ensure logs are parsed correctly. Microsoft’s official documentation (https://docs.microsoft.com/azure/sentinel/connect-cef) provides detailed instructions on configuring CEF-based data connectors.
- A. Correct.
Correct: For CEF-based logs from on-premises devices, you typically deploy the Azure Monitor or Log Analytics agent on a Linux server, configure Syslog to receive logs from the devices, and enable the CEF connector in Sentinel. This approach ensures that the logs are parsed correctly as CEF.
- B. Incorrect.
Incorrect: The Azure AD connector is designed to bring in logs from Azure AD, such as sign-ins, audit logs, and risk reports. It does not support collecting on-premises CEF logs from network devices.
- C. Incorrect.
Incorrect: Simply sending logs over HTTPS to Sentinel without using a supported data connector or agent will not benefit from Sentinel’s built-in CEF parsing. Devices cannot directly send CEF logs to the workspace without proper agent or connector configuration.
- D. Incorrect.
Incorrect: While the Log Analytics agent can be installed on some servers, installing it directly on each firewall or network device is typically not possible or supported. Using a dedicated Linux VM or appliance is the recommended setup for collecting CEF logs.