SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Sentinel Capabilities 3

Question 1

What is the relationship between Microsoft Sentinel and Azure Log Analytics?

Accepted Answer

Microsoft Sentinel is built on top of Azure Log Analytics workspaces

Answer

Microsoft Sentinel is built on Azure Log Analytics, using the Log Analytics workspace as its underlying data store for all ingested security data.

Question 2

What does SOAR stand for in the context of Microsoft Sentinel?

Accepted Answer

Security Orchestration, Automation, and Response

Answer

SOAR stands for Security Orchestration, Automation, and Response, and Microsoft Sentinel's playbook functionality provides SOAR capabilities.

Question 3

Which Microsoft Sentinel feature leverages AI and machine learning to detect anomalies without pre-written rules?

Accepted Answer

Fusion detection

Answer

Microsoft Sentinel's Fusion detection uses machine learning to correlate low-fidelity signals across multiple data sources to detect multi-stage attack scenarios.

Question 4

What is the purpose of Incidents in Microsoft Sentinel?

Accepted Answer

To group related alerts into a single actionable investigation case

Answer

Incidents in Microsoft Sentinel aggregate related alerts into a single case, providing analysts with a unified view for investigating a potential attack.

Question 5

Which built-in role grants read-only access to Microsoft Sentinel data, workbooks, and incidents?

Accepted Answer

Microsoft Sentinel Reader

Answer

The Microsoft Sentinel Reader role allows users to view data, incidents, workbooks, and other Sentinel resources without the ability to make changes.

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Sentinel Capabilities 3