SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Sentinel Capabilities 5

Question 1

Which Microsoft Sentinel analytics rule type runs on a fixed schedule and queries historical log data?

Accepted Answer

Scheduled analytics rules

Answer

Scheduled analytics rules in Microsoft Sentinel run KQL queries against log data at configurable intervals (e.g., every 5 minutes or every hour) to detect threats in historical data.

Question 2

What is the purpose of Near-Real-Time (NRT) analytics rules in Microsoft Sentinel?

Accepted Answer

To provide alert generation within about one minute of data ingestion for time-sensitive detections

Answer

NRT rules in Microsoft Sentinel run approximately every minute, providing much faster detection than standard scheduled rules for high-priority, time-sensitive threat scenarios.

Question 3

Which Microsoft Sentinel feature allows security teams to simulate attacks and test their detection coverage?

Accepted Answer

Hunting queries with simulation tags

Answer

Security teams can create hunting queries tagged for specific attack simulations to test whether their analytics rules and detections would catch particular adversarial behaviors.

Question 4

What does the Microsoft Sentinel Responder role allow users to do?

Accepted Answer

Manage and act on incidents (assign, change status, add comments) but not create or modify analytics rules

Answer

The Microsoft Sentinel Responder role allows analysts to manage incidents — assign them, update their status, and add comments — but not modify the underlying detection configurations.

Question 5

How does Microsoft Sentinel handle multi-cloud environments?

Accepted Answer

It can ingest data from AWS, GCP, and other cloud providers through data connectors

Answer

Microsoft Sentinel supports multi-cloud environments by providing data connectors for AWS services (like CloudTrail and S3), GCP, and other third-party cloud platforms.

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Sentinel Capabilities 5