SC-900 - Microsoft Security, Compliance, and Identity Fundamentals Microsoft Sentinel Capabilities Questions and Answers

Question 1

An organization wants to automatically perform a series of actions, such as blocking a user in Microsoft Entra ID and creating a ticket in a service management system, whenever a high-severity incident is generated in Microsoft Sentinel.
Which capability enables this type of automated, multi-step response?

Accepted Answer

Playbooks

Answer

Workbooks

Answer

Analytics Rules

Answer

Data Connectors

Question 2

A security manager needs a single, interactive dashboard to visualize security trends, see alerts from various data sources, and monitor incident metrics over time. Which Microsoft Sentinel feature is best suited for creating these kinds of rich, visual reports?

Accepted Answer

Workbooks

Answer

Playbooks

Answer

Hunting Queries

Answer

Data Connectors

Question 3

An organization needs to ingest security data from various sources, including Microsoft Entra ID, on-premises firewalls, and other third-party cloud applications, into a central location for analysis. Which Microsoft Sentinel component is specifically designed for this data collection purpose?

Accepted Answer

Data Connectors

Answer

Analytics Rules

Answer

Incidents

Answer

Workbooks

Question 4

A security analyst has developed a Kusto Query Language (KQL) query that successfully identifies a specific type of suspicious activity. To ensure alerts are automatically generated whenever this pattern occurs in the future, what should the analyst create in Microsoft Sentinel using this query?

Accepted Answer

An analytics rule

Answer

A workbook

Answer

A playbook

Answer

A data connector

Question 5

Microsoft Sentinel combines the functionalities of two major security solution categories into a single, cloud-native platform. What are these two categories?

Accepted Answer

Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR)

Answer

Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR)

Answer

Cloud Access Security Broker (CASB) and Cloud Security Posture Management (CSPM)

Answer

Identity and Access Management (IAM) and Privileged Identity Management (PIM)

Question 6

A security analyst receives intelligence about a new attack technique that does not yet have a predefined detection rule. The analyst wants to proactively search through all collected log data for indicators related to this new technique. Which Microsoft Sentinel feature is designed for this type of proactive investigation?

Accepted Answer

Hunting

Answer

Playbooks

Answer

Workbooks

Answer

Incidents