Microsoft Azure Security Engineer Certification Azure Security Operations and Monitoring

Question 1

What is Microsoft Sentinel primarily classified as in the security operations space?

Accepted Answer

Cloud-native SIEM and SOAR platform

Answer

Microsoft Sentinel is a cloud-native Security Information and Event Management and Security Orchestration, Automation, and Response platform.

Question 2

What is the role of Microsoft Sentinel data connectors?

Accepted Answer

Ingest security logs from Microsoft and third-party sources into the workspace

Answer

Data connectors pull log data from sources such as Azure AD, Microsoft Defender, Syslog, and third-party security products into Sentinel.

Question 3

Which Microsoft Sentinel component contains KQL-based detection logic that runs on a schedule and generates alerts when triggered?

Accepted Answer

Analytics rules

Answer

Scheduled analytics rules run KQL queries against ingested data at defined intervals and create incidents when the query returns results.

Question 4

What technology underpins a Microsoft Sentinel playbook that automates incident response actions?

Accepted Answer

Azure Logic Apps with Sentinel connectors

Answer

Sentinel playbooks are Azure Logic Apps that can be triggered automatically by automation rules or manually from an incident.

Question 5

Which Microsoft Defender for Cloud workload protection plan provides threat detection and EDR integration for Azure and on-premises VMs?

Accepted Answer

Defender for Servers

Answer

Microsoft Defender for Servers provides behavioral analytics, threat detection, and Microsoft Defender for Endpoint EDR integration for VMs.

Microsoft Azure Security Engineer Certification Practice Test