SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Sentinel Capabilities 2 — Questions and Answers
Question 1: What type of data connectors does Microsoft Sentinel use to ingest data from Microsoft 365 services?
- JDBC connectors
- Built-in Microsoft connectors (Correct answer)
- Third-party REST APIs only
- Manual CSV uploads
Correct answer: Built-in Microsoft connectors
Microsoft Sentinel provides built-in Microsoft connectors that natively integrate with Microsoft 365, Azure AD, and other Microsoft services for seamless data ingestion.
Question 2: Which Microsoft Sentinel feature allows security analysts to automate responses to detected threats?
- Workbooks
- Playbooks (Correct answer)
- Watchlists
- Hunting queries
Correct answer: Playbooks
Playbooks in Microsoft Sentinel are automated workflows built on Azure Logic Apps that can execute response actions when an alert or incident is triggered.
Question 3: What is the primary purpose of Microsoft Sentinel Workbooks?
- To automate incident response
- To store threat intelligence feeds
- To visualize and monitor security data through interactive dashboards (Correct answer)
- To configure data connectors
Correct answer: To visualize and monitor security data through interactive dashboards
Microsoft Sentinel Workbooks provide interactive visual dashboards built on Azure Monitor Workbooks for monitoring and analyzing security data.
Question 4: In Microsoft Sentinel, what are Analytics Rules primarily used for?
- Visualizing security data
- Detecting threats by generating alerts from log data (Correct answer)
- Storing raw log data
- Managing user permissions
Correct answer: Detecting threats by generating alerts from log data
Analytics Rules in Microsoft Sentinel query log data on a schedule and generate security alerts and incidents when suspicious patterns are detected.
Question 5: Which Microsoft Sentinel component helps analysts proactively search for threats that haven't triggered automated alerts?
- Incidents
- Playbooks
- Hunting (Correct answer)
- Watchlists
Correct answer: Hunting
Microsoft Sentinel's Hunting capability allows security analysts to proactively query data looking for indicators of compromise before an alert is generated.
Question 6: What is a Microsoft Sentinel Watchlist?
- A list of blocked IP addresses in the firewall
- A curated set of data imported from external sources used to correlate against event data (Correct answer)
- A queue of pending incidents for analysts
- A list of approved software applications
Correct answer: A curated set of data imported from external sources used to correlate against event data
Watchlists are imported datasets (such as lists of critical assets or known bad IPs) that can be referenced in analytics rules and hunting queries to enrich detection logic.
Question 7: Which language is used to write queries in Microsoft Sentinel for log analysis and hunting?
- SQL
- Python
- Kusto Query Language (KQL) (Correct answer)
- PowerShell
Correct answer: Kusto Query Language (KQL)
Microsoft Sentinel uses Kusto Query Language (KQL) to query data stored in Log Analytics workspaces for analysis, detection rules, and hunting.
SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Sentinel Capabilities 2
What type of data connectors does Microsoft Sentinel use to ingest data from Microsoft 365 services?