SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Sentinel Capabilities 5 — Questions and Answers
Question 1: Which Microsoft Sentinel analytics rule type runs on a fixed schedule and queries historical log data?
- Near-real-time (NRT) rules
- Scheduled analytics rules (Correct answer)
- Fusion rules
- Microsoft Security rules
Correct answer: Scheduled analytics rules
Scheduled analytics rules in Microsoft Sentinel run KQL queries against log data at configurable intervals (e.g., every 5 minutes or every hour) to detect threats in historical data.
Question 2: What is the purpose of Near-Real-Time (NRT) analytics rules in Microsoft Sentinel?
- To replace all scheduled rules with faster processing
- To provide alert generation within about one minute of data ingestion for time-sensitive detections (Correct answer)
- To analyze data from the past 90 days only
- To automatically close low-severity incidents
Correct answer: To provide alert generation within about one minute of data ingestion for time-sensitive detections
NRT rules in Microsoft Sentinel run approximately every minute, providing much faster detection than standard scheduled rules for high-priority, time-sensitive threat scenarios.
Question 3: Which Microsoft Sentinel feature allows security teams to simulate attacks and test their detection coverage?
- Sentinel Playbooks
- Attack simulation training integration with Sentinel
- Sentinel Notebooks for red team exercises
- Hunting queries with simulation tags (Correct answer)
Correct answer: Hunting queries with simulation tags
Security teams can create hunting queries tagged for specific attack simulations to test whether their analytics rules and detections would catch particular adversarial behaviors.
Question 4: What does the Microsoft Sentinel Responder role allow users to do?
- Only view incidents without taking any action
- Manage and act on incidents (assign, change status, add comments) but not create or modify analytics rules (Correct answer)
- Create and delete analytics rules and data connectors
- Administer playbook executions and Logic App configurations
Correct answer: Manage and act on incidents (assign, change status, add comments) but not create or modify analytics rules
The Microsoft Sentinel Responder role allows analysts to manage incidents — assign them, update their status, and add comments — but not modify the underlying detection configurations.
Question 5: How does Microsoft Sentinel handle multi-cloud environments?
- It only supports Microsoft Azure data sources
- It can ingest data from AWS, GCP, and other cloud providers through data connectors (Correct answer)
- Multi-cloud support requires a separate Microsoft Defender license
- Only on-premises data sources can be connected alongside Azure
Correct answer: It can ingest data from AWS, GCP, and other cloud providers through data connectors
Microsoft Sentinel supports multi-cloud environments by providing data connectors for AWS services (like CloudTrail and S3), GCP, and other third-party cloud platforms.
Question 6: What is the primary benefit of using Microsoft Sentinel as a cloud-native SIEM over traditional on-premises SIEM solutions?
- It provides free unlimited data storage with no egress fees
- It eliminates infrastructure management and scales automatically with data volume (Correct answer)
- It only works with Microsoft products, ensuring compatibility
- It requires no configuration or rule creation to detect threats
Correct answer: It eliminates infrastructure management and scales automatically with data volume
As a cloud-native SIEM, Microsoft Sentinel removes the burden of managing servers and storage hardware, and scales elastically to accommodate growing data volumes without capacity planning.
Question 7: Which Microsoft Sentinel feature provides a visual representation of an attack's progression across entities like users, hosts, and IPs during an investigation?
- The Workbooks gallery
- The Investigation Graph (Correct answer)
- The Content Hub
- The UEBA timeline
Correct answer: The Investigation Graph
The Investigation Graph in Microsoft Sentinel visually maps relationships between entities (users, devices, IPs) involved in an incident to help analysts understand the scope and progression of an attack.
SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Sentinel Capabilities 5
Which Microsoft Sentinel analytics rule type runs on a fixed schedule and queries historical log data?