Q: 16
HOTSPOT Your on-premises network contains a Hyper-V cluster. The cluster contains the virtual machines shown in the following table. 
You have a Microsoft Sentinel workspace named SW1. You have a data collection rule (OCR) that has the following configurations: • Name: DCR1 • Destination: SW1 • Platform type: All • Data collection endpoint: None • Data source: Windows event logs, Linux syslog For each of the following statements, select Yes if the statement is true. Otherwise, select No. . 
Your Answer
Discussion
I don’t think it’s Yes, No, No. If the DCR is set to “platform type: All”, wouldn’t the Linux VM also get logged as long as it's using syslog? The "No" for Linux is a common trap in these, but here it should be Yes.
No doubts here-Yes, No, Yes is the right combo. Platform type set to All means Windows event logs and Linux syslog get pulled if the agent's there, even without a data collection endpoint. Anyone see it differently?
This looks like one of those practice labs from the official SC-200 study set. Checking the Microsoft docs or testing in a real Sentinel workspace helps since agent setup and platform type can trip people up.
Pretty sure it's Yes, No, No. Saw a similar question in a practice set and that's what matched.
Be respectful. No spam.