Selecting the Common Windows Security event set to get a user audit trail while minimizing volume

Ingest data into the Microsoft Sentinel SIEM and platform
Answer Correct answer: B — The Common set includes user sign-in (4624) and sign-out (4634) events, meeting the audit trail with lower volume than All events.

You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1 and 100 virtual machines that run Windows Server. You need to configure the collection of Windows Security event logs for ingestion to WS1. The solution must meet the following requirements: • Capture a full user audit trail including user sign-in and user sign-out events. • Minimize the volume of events. • Minimize administrative effort. Which event set should you select?

  1. Minimal
  2. Common Correct Answer
  3. All events
  4. Custom
sentinel windows security events common event set windows security event connector

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The Common set is a curated, standard group of audit events that includes both user sign-in and sign-out events, giving the required audit trail at far lower volume than the All-events set and with no custom tuning.

To ingest Windows Security event logs into Sentinel with a full user sign-in/sign-out audit trail while minimizing event volume and effort, select the Common event set, which includes user sign-in (4624) and sign-out (4634) events.

Choosing All events to be safe — it captures the audit trail but at maximum volume, violating the minimize-volume requirement; the Common set already covers sign-in/sign-out.

Community Discussion (4 comments)

sapphire 👍 3 Selected: B
Common - A standard set of events for auditing purposes. A full user audit trail is included in this set. For example, it contains both user sign-in and user sign-out events (event IDs 4624, 4634).
rsanx42 👍 2 Selected: B
B is correct. https://learn.microsoft.com/en-us/azure/sentinel/windows-security-event-id-reference
ostralo 👍 3 Selected: B
https://learn.microsoft.com/en-us/azure/sentinel/windows-security-event-id-reference
mayu01 👍 1
A by chat gpt

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Sentinel's Windows Security event connector offers Minimal, Common, All, and Custom sets. The Common set is described as a standard set for auditing and explicitly includes both user sign-in (4624) and user sign-out (4634) events, satisfying the full user audit-trail requirement while keeping event volume modest and requiring no custom configuration.

Why the Other Options Are Wrong

All events (C) meets the audit requirement but maximizes volume, contradicting the minimize-volume goal. Minimal (A) is too small to guarantee the sign-in/sign-out audit trail. Custom (D) would meet the goal but requires more administrative effort to define, contradicting minimize-effort.

Community Comment Notes

The community is unanimous (B 100). sapphire and ostralo cite the Windows Security event ID reference, confirming the Common set contains 4624 and 4634 and is the right balance of coverage and volume.

Official Reference

https://learn.microsoft.com/en-us/azure/sentinel/windows-security-event-id-reference

Related Analysis

You have an Azure subscription. You need to stream the Micro

A-Grade

You have an Azure subscription that contains a resource grou

S-Grade

You have a Microsoft 365 subscription that uses Microsoft De

S-Grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide