StudyByteLearn
← AZ-802: Administering Windows Server
AZ-802 · Monitoring and troubleshooting · Monitoring and troubleshooting | Monitor by using Windows Server tools and Azure services

Practice question 396 of 506 · medium

A standard AMA DCR collects Security events to Azure Monitor Logs. Which table should be queried first?

Choose the single best answer.

  1. A.Event
  2. B.AzureActivity
  3. C.SecurityEvent regardless of collection route
  4. D.InsightsMetrics
Show the answer and explanation

✓ Correct answer

  • Event

Standard Windows event DCR collection writes Event. SecurityEvent is used by the relevant Sentinel connector route; InsightsMetrics stores classic predefined performance; AzureActivity records management operations.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.