Microsoft Azure Security Engineer Certification Azure Security Operations and Monitoring

Question 1

What is Microsoft Sentinel primarily classified as in the security operations space?

Accepted Answer

Cloud-native SIEM and SOAR platform

Answer

Vulnerability scanner and patch manager

Answer

Identity governance and access management tool

Answer

Network firewall and DDoS protection service

Question 2

What is the role of Microsoft Sentinel data connectors?

Accepted Answer

Ingest security logs from Microsoft and third-party sources into the workspace

Answer

Define detection rule logic in KQL

Answer

Deploy Azure Firewall policies to connected subscriptions

Answer

Synchronize threat intelligence feeds only

Question 3

Which Microsoft Sentinel component contains KQL-based detection logic that runs on a schedule and generates alerts when triggered?

Accepted Answer

Analytics rules

Answer

Workbooks

Answer

Playbooks

Answer

Hunting queries

Question 4

What technology underpins a Microsoft Sentinel playbook that automates incident response actions?

Accepted Answer

Azure Logic Apps with Sentinel connectors

Answer

Azure Functions with HTTP triggers

Answer

PowerShell runbooks in Azure Automation

Answer

GitHub Actions workflows

Question 5

Which Microsoft Defender for Cloud workload protection plan provides threat detection and EDR integration for Azure and on-premises VMs?

Accepted Answer

Defender for Servers

Answer

Defender for Containers

Answer

Defender for Storage

Answer

Defender for Key Vault

Question 6

What does the Secure Score in Microsoft Defender for Cloud represent?

Accepted Answer

A percentage reflecting how many security recommendations have been implemented

Answer

A DDoS attack risk probability rating

Answer

An industry compliance certification status

Answer

A threat intelligence confidence level for alerts