You have 100 Azure subscriptions that have enhanced security features m Microsoft Defender for Cloud enabled.
All the subscriptions are linked to a single Azure AD tenant. You need to stream the Defender for Cloud togs to a syslog server.
The solution must minimize administrative effort.
What should you do?
To answer, select the appropriate options in the answer area NOTE: Each correct selection is worth one point
Correct Answer:
Export logs to: # Azure event hub
* Configure streaming by: # Configuring continuous export in Defender for Cloud for each subscription In Microsoft Defender for Cloud , if you need to stream security alerts and recommendations to an external SIEM or syslog server , the supported approach is to export data to an Azure Event Hub , which ac ts as a streaming pipeline. The syslog server or SIEM solution can then pull data from the Event Hub in real time using connectors or custom listeners.
The configuration method for sending Defender for Cloud data to an Event Hub is known as continuous expo rt . According to Microsoft's official Defender for Cloud documentation, continuous export lets you automatically stream alerts and security recommendations to Event Hubs or Log Analytics workspaces .
However, when your target is a syslog server , Event Hub i s required because it supports continuous streaming outside Azure.
To minimize administrative effort across multiple subscriptions (100 in this case) , you can use Azure Policy or a script to apply continuous export settings per subscription , but the featur e must still be enabled individually for each subscription - hence the correct configuration step is:
"Configuring continuous export in Defender for Cloud for each subscription." Why not other options:
* Log Analytics workspace: used for querying within Azure, not for streaming to external syslog servers.
* Azure Storage account: suitable for archival, not streaming.
* Modifying diagnostic settings of the tenant: applies only to Azure AD logs, not Defender for Cloud data.