正解:C
According to Microsoft Defender for Cloud documentation, continuous export allows you to stream security alerts and recommendations to other monitoring or SIEM systems. When exporting alerts in real time, Azure Event Hubs is the supported mechanism. Event Hubs provides a scalable data-streaming platform that can feed events into third-party SIEM tools such as Splunk, IBM QRadar, or ArcSight. Microsoft states: "To enable real-time streaming of security alerts or recommendations, configure Continuous Export to Azure Event Hubs. From there, your external SIEM or event processing solution can consume the data." The other options serve different purposes:
* Azure Cosmos DB is a NoSQL database, not used for alert streaming.
* Azure Event Grid is for reactive event-driven automation but not intended for continuous log export.
* Azure Data Lake is for large-scale storage and analytics, not streaming.
Thus, exporting Defender alerts to Azure Event Hubs is the correct and supported configuration for continuous export to third-party SIEM solutions.