Question 32

Question

HOTSPOT You have on-premises servers that run Windows Server. You have a Microsoft Sentinel workspace named SW1. SW1 is configured to collect Windows Security log entries from the servers by using the Azure Monitor Agent data connector. You plan to limit the scope of collected events to events 4624 and 462S only. You need to use a PowerShell script to validate the syntax of the filter applied to the connector. How should you complete the script? To answer, select the appropriate options in the answer area.

Casey H. · Answer

Validate-AzSentinelDataConnectorPretty sure this is the right cmdlet since you want to validate the filter on a Sentinel connector that's using Azure Monitor Agent. Test-AzureRmMonitorLogAnalyticsQuery tests queries after ingestion, not connector filters. Let me know if anyone's done it differently.

Ishaan · Answer

Not Test-AzureRmMonitorLogAnalyticsQuery, it's Validate-AzSentinelDataConnector for checking connector filter syntax, pretty sure on that.

Taylor T. · Answer

I get why Test-AzureRmMonitorLogAnalyticsQuery looks tempting, but for checking the filter syntax specifically on a Sentinel data connector, I think it's actually Validate-AzSentinelDataConnector. The other cmdlet is more for testing queries after the data's ingested. Not totally sure, especially if they change agent types, but that's what I've seen in recent labs.

Drew V. · Answer

I think you'd use Test-AzureRmMonitorLogAnalyticsQuery to check this filter.

MethodicalArchitect1892 · Answer

Validate-AzSentinelDataConnector. Not 100 percent but since it's Azure Monitor Agent that seems like the best fit here.

Microsoft SC-200 Security Operations Analyst Real Exam Questions [October 2026 Update] Quiz

Premium Access Includes