Free SC-900 Microsoft Sentinel as SIEM and SOAR Questions and Answers — Questions and Answers
Question 1: What are the two primary functions that define Microsoft Sentinel's role in a security operations center?
- Firewall and Antivirus
- SIEM and SOAR (Correct answer)
- Identity and Access Management
- Data Loss Prevention and Information Protection
Correct answer: SIEM and SOAR
Microsoft Sentinel combines Security Information and Event Management (SIEM) for collecting and analyzing security data, and Security Orchestration, Automation, and Response (SOAR) for automating responses to threats. This dual capability allows organizations to both detect and react to security incidents from a single platform.
Question 2: How does Microsoft Sentinel collect log data from various sources like Azure services, Microsoft 365, and on-premises systems?
- Using analytics rules
- Through Azure Policy assignments
- By configuring data connectors (Correct answer)
- Via Sentinel playbooks
Correct answer: By configuring data connectors
Data connectors are the built-in components used to ingest data from a wide range of Microsoft and third-party sources into Microsoft Sentinel. They simplify the process of connecting data sources to the Log Analytics workspace that Sentinel uses.
Question 3: In Microsoft Sentinel, what component, powered by Azure Logic Apps, is used to automate responses to security alerts?
- Workbooks
- Hunting queries
- Data connectors
- Playbooks (Correct answer)
Correct answer: Playbooks
Playbooks in Microsoft Sentinel are collections of procedures that can be run automatically in response to an alert. They are built on Azure Logic Apps, allowing for complex, automated workflows that can interact with various services to contain and remediate threats.
Question 4: What is the term for a group of related alerts in Microsoft Sentinel that are aggregated to represent a potential security attack?
- An Event
- An Incident (Correct answer)
- A Workbook
- A Playbook
Correct answer: An Incident
Microsoft Sentinel uses fusion technology and analytics rules to correlate millions of low-fidelity alerts into a manageable number of high-fidelity incidents. An incident is a collection of related alerts that, together, form an actionable attack story.
Question 5: Which query language is used to create analytics rules, perform threat hunting, and visualize data in Microsoft Sentinel workbooks?
- SQL
- PowerShell
- Kusto Query Language (KQL) (Correct answer)
- Python
Correct answer: Kusto Query Language (KQL)
Kusto Query Language (KQL) is the language used to query the Log Analytics workspace where all Microsoft Sentinel data is stored. Analysts use KQL to write detection rules, hunt for threats, and build custom visualizations in workbooks.
Question 6: A security analyst wants to proactively search for new and unknown threats in their organization's data. Which Microsoft Sentinel feature should they use?
- Incidents
- Workbooks
- Data Connectors
- Hunting (Correct answer)
Correct answer: Hunting
Threat hunting is the proactive process of searching for cyber threats that are lurking undetected in a network. Microsoft Sentinel provides powerful search and query tools, including built-in hunting queries, to guide security analysts in this process.
Free SC-900 Microsoft Sentinel as SIEM and SOAR Questions and Answers
What are the two primary functions that define Microsoft Sentinel's role in a security operations center?