Selecting the Common Windows Security event set to get a user audit trail while minimizing volume

SC-200 By islever Editorial Last updated

Ingest data into the Microsoft Sentinel SIEM and platform

Short answer

B The Common set includes user sign-in (4624) and sign-out (4634) events, meeting the audit trail with lower volume than All events.

Question

You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1 and 100 virtual machines that run Windows Server. You need to configure the collection of Windows Security event logs for ingestion to WS1. The solution must meet the following requirements: • Capture a full user audit trail including user sign-in and user sign-out events. • Minimize the volume of events. • Minimize administrative effort. Which event set should you select?
  1. Minimal
  2. Common Correct Answer
  3. All events
  4. Custom

Key Takeaways

The Common set is a curated, standard group of audit events that includes both user sign-in and sign-out events, giving the required audit trail at far lower volume than the All-events set and with no custom tuning.

To ingest Windows Security event logs into Sentinel with a full user sign-in/sign-out audit trail while minimizing event volume and effort, select the Common event set, which includes user sign-in (4624) and sign-out (4634) events.

Common mistake: Choosing All events to be safe — it captures the audit trail but at maximum volume, violating the minimize-volume requirement; the Common set already covers sign-in/sign-out.

Expert Analysis

Why the Answer Is Correct

Sentinel's Windows Security event connector offers Minimal, Common, All, and Custom sets. The Common set is described as a standard set for auditing and explicitly includes both user sign-in (4624) and user sign-out (4634) events, satisfying the full user audit-trail requirement while keeping event volume modest and requiring no custom configuration.

Why the Other Options Are Wrong

All events (C) meets the audit requirement but maximizes volume, contradicting the minimize-volume goal. Minimal (A) is too small to guarantee the sign-in/sign-out audit trail. Custom (D) would meet the goal but requires more administrative effort to define, contradicting minimize-effort.

Community Comment Notes

The community is unanimous (B 100). sapphire and ostralo cite the Windows Security event ID reference, confirming the Common set contains 4624 and 4634 and is the right balance of coverage and volume.

Official Reference

https://learn.microsoft.com/en-us/azure/sentinel/windows-security-event-id-reference

This link opens the official vendor documentation in a new tab.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. sapphire 👍 3 Answered B
    Common - A standard set of events for auditing purposes. A full user audit trail is included in this set. For example, it contains both user sign-in and user sign-out events (event IDs 4624, 4634).
  2. ostralo 👍 3 Answered B
    https://learn.microsoft.com/en-us/azure/sentinel/windows-security-event-id-reference
  3. rsanx42 👍 2 Answered B
    B is correct. https://learn.microsoft.com/en-us/azure/sentinel/windows-security-event-id-reference
  4. mayu01 👍 1
    A by chat gpt

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide