Security Operations & Monitoring

Which Microsoft service provides a unified secure score, security recommendations, and regulatory compliance assessments across your Azure subscriptions?

• AMicrosoft Defender for Cloud✓
• BAzure Monitor Workbooks
• CMicrosoft Entra ID Protection
• DMicrosoft Sentinel

Answer: Microsoft Defender for Cloud is the cloud security posture management and workload protection platform that surfaces secure score, recommendations, and compliance assessments. Microsoft Sentinel is the SIEM for threat detection and response.

You want a cloud-native SIEM and SOAR solution to collect security logs from Azure and third-party sources, run analytics rules, and automate response with playbooks. Which service should you deploy?

• AMicrosoft Sentinel✓
• BAzure Network Watcher
• CAzure Monitor metrics
• DMicrosoft Defender for Cloud

Answer: Microsoft Sentinel is the cloud-native SIEM and SOAR that ingests data via connectors, applies analytics rules to generate incidents, and automates response with Logic Apps playbooks. Defender for Cloud focuses on posture and workload protection rather than SIEM correlation.

In Microsoft Sentinel, which component allows you to ingest sign-in and audit logs from Microsoft Entra ID?

• AA data connector✓
• BA workbook
• CA hunting query
• DA watchlist

Answer: Data connectors are the configurable integrations that bring logs, such as Microsoft Entra ID sign-in and audit logs, into the Sentinel workspace. Workbooks visualize data and hunting queries proactively search it once it is ingested.

You must retain Azure resource activity logs and route them to a Log Analytics workspace for long-term querying and alerting. What should you configure?

• AA diagnostic setting that sends the activity log to Log Analytics✓
• BA backup vault, retaining recovery points for protected workloads rather than platform log data
• CNetwork security group flow logs, recording allowed and denied traffic flows but no control-plane events
• DA budget alert in Cost Management

Answer: A diagnostic setting routes the Azure activity log and resource logs to a Log Analytics workspace, enabling long-term retention, queries, and alerts. Flow logs capture network traffic, not control-plane activity.

Which Microsoft Defender for Cloud plan provides advanced threat protection alerts for suspicious activity such as anomalous access patterns on Azure Storage accounts?

• AAzure Policy
• BNetwork Watcher Connection Monitor
• CMicrosoft Defender for Storage✓
• DMicrosoft Defender for DNS only

Answer: Microsoft Defender for Storage analyzes telemetry to detect threats such as anomalous access, suspicious uploads, and potential data exfiltration on storage accounts. The other options do not provide storage-specific threat detection.

To capture and inspect IP traffic flowing through a virtual network, including how its network security groups treated that traffic, for forensic analysis, which Azure Network Watcher feature should you enable?

• AIP flow verify
• BVirtual network flow logs✓
• CConnection troubleshoot
• DEffective security rules view

Answer: Virtual network flow logs record inbound and outbound IP traffic through a virtual network, including the network security group rules applied, and store it for analysis, including with traffic analytics. They replace NSG flow logs, which no longer accept new configurations and retire on 30 September 2027. IP flow verify only checks whether a specific packet would be allowed or denied.

In Microsoft Sentinel, which feature lets analysts proactively search across data for threats using prebuilt or custom queries before an alert fires?

• AHunting✓
• BIncidents
• CData connectors
• DAutomation rules

Answer: The Hunting feature provides queries that let analysts proactively look for malicious activity across ingested data before automated detections trigger incidents. Incidents represent already-detected alerts grouped together.

You want incidents in Microsoft Sentinel to automatically trigger a notification and a containment action when a high-severity alert is created. Which combination achieves this?

• AA watchlist lookup enriching a query
• BA diagnostic setting, which forwards logs to a destination workspace and takes no action on incidents
• CAn automation rule that runs a playbook✓
• DA workbook with a scheduled refresh, redrawing visualisations of data that is already collected

Answer: An automation rule can trigger on incident creation and invoke a Logic Apps playbook to send notifications and perform containment actions, implementing SOAR. Workbooks and watchlists do not execute response actions.

You want a continuously updated count of active security alerts across your subscriptions surfaced in a single Azure portal dashboard for the security team. Which Microsoft Defender for Cloud area provides this overview?

• AThe Network Watcher topology view, drawing the resources in a virtual network and the connections between them
• BThe security alerts page in Microsoft Defender for Cloud✓
• CCost Management, reporting spending by subscription and resource group against a budget
• DAn Azure Policy assignment at scope

Answer: The security alerts page in Microsoft Defender for Cloud aggregates and lists active alerts from across enabled plans, letting the security team triage them centrally. Network Watcher and Cost Management do not present security alerts.

You want to reduce alert fatigue in Microsoft Sentinel by automatically grouping related alerts into a single incident based on shared entities. Which feature controls this grouping?

• AAlert grouping settings in an analytics rule✓
• BA workbook
• CA watchlist
• DA diagnostic setting

Answer: Analytics rules include alert grouping settings that combine alerts sharing specified entities or attributes into one incident within a time window, reducing duplicate incidents. Workbooks and watchlists do not perform incident grouping.

You need to enrich Microsoft Sentinel detections with a curated list of high-value asset IP addresses that analytics and hunting queries can reference. Which Sentinel feature should you use?

• AAn automation rule
• BA playbook
• CA data connector
• DA watchlist✓

Answer: A watchlist stores a curated reference dataset, such as high-value IP addresses, that analytics rules and hunting queries can join against to add context. Playbooks and automation rules perform response actions rather than provide reference data.

You want a periodic, automated email to stakeholders summarizing the organization's secure score trend from Microsoft Defender for Cloud. Which built-in capability supports scheduled posture reporting?

• ANetwork Watcher IP flow verify, testing whether a packet to or from a virtual machine would be allowed by the effective security rules
• BA resource lock set to CanNotDelete on the subscription, which stops resources being removed and reports nothing about posture
• CNetwork security group flow logs written to a storage account, recording the traffic flows allowed and denied at each rule
• DMicrosoft Defender for Cloud email notifications and continuous export to a workbook or Log Analytics✓

Answer: Microsoft Defender for Cloud supports configured email notifications and continuous export of secure score and recommendations to Log Analytics or Event Hubs, where workbooks can present trends for stakeholders. Network Watcher tools do not report posture.

You must trigger an Azure Monitor alert and an automated email whenever a specific high-risk operation, such as a Key Vault delete, appears in the activity log. What should you create?

• AA budget alert
• BAn activity log alert with an action group✓
• CA route table
• DA network security group rule

Answer: An activity log alert can match specific control-plane operations, such as deleting a Key Vault, and an associated action group sends notifications or runs automation. Budget alerts track spending, not security operations.

You want to detect potential data exfiltration and anomalous management operations against Azure resources by enabling threat detection at the subscription control plane. Which Microsoft Defender for Cloud plan covers Azure Resource Manager operations?

• AMicrosoft Defender for SQL
• BMicrosoft Defender for Storage
• CMicrosoft Defender for Resource Manager✓
• DMicrosoft Defender for DNS

Answer: Microsoft Defender for Resource Manager monitors management operations performed through Azure Resource Manager and alerts on suspicious activity such as anomalous use of privileged operations. The other plans protect specific workloads rather than the control plane.

You want analysts to investigate a Microsoft Sentinel incident visually, seeing related entities such as users, hosts, and IP addresses and their connections. Which feature provides this?

• AA diagnostic setting, which routes logs from a resource into the workspace before any analysis
• BA watchlist
• CThe investigation graph✓
• DA data connector bringing a new source of signals into the workspace on a schedule

Answer: The investigation graph in Microsoft Sentinel visually maps an incident's entities and their relationships, letting analysts pivot and expand to understand scope. Data connectors and diagnostic settings handle ingestion, not visualization.

You want to ensure logs ingested into a Log Analytics workspace are retained for two years for security investigations while controlling cost on older data. Which setting should you adjust?

• AA network security group, allowing or denying traffic with no effect on how long logs are kept
• BA shared access signature granting temporary access to storage data rather than governing retention
• CA resource lock that stops the workspace being deleted
• DThe workspace data retention and archive settings✓

Answer: Log Analytics workspace retention settings let you configure interactive retention and an archive tier so security data is kept for the required period at lower cost for older logs. Network and access controls do not govern retention duration.

You need Microsoft Sentinel to automatically close incidents that match a known benign pattern, such as a specific scheduled scanner, without analyst action. Which feature should you use?

• AA data connector bringing a new source of events into the workspace on a schedule
• BA watchlist holding the scanner addresses for a query to look up during triage
• CA workbook filtered to the scanner so the incidents can be charted over time
• DAn automation rule with a condition that sets the incident status to Closed✓

Answer: An automation rule can match incident properties, such as a known scanner source, and automatically set the status to Closed with a classification, reducing analyst workload. Workbooks visualise data and watchlists provide reference data, not incident actions.

To proactively detect threats in Microsoft Sentinel before alerts fire, an analyst wants to run scheduled background searches and be notified of matches. Which capability supports scheduled hunting with notifications via livestream or bookmarks?

• AA storage firewall
• BHunting queries with livestream and bookmarks✓
• CData connectors
• DA diagnostic setting on the workspace

Answer: Hunting in Sentinel provides queries, livestream for near-real-time monitoring of a hunt, and bookmarks to preserve findings for investigation, enabling proactive threat hunting. Data connectors handle ingestion, not hunting.

Your SOC must correlate Microsoft Entra sign-in logs with firewall logs to detect a pattern spanning both sources within Microsoft Sentinel. Which Sentinel component expresses this multi-source detection logic?

• AA data connector, the component that lands each log source in the workspace before any detection logic runs
• BA scheduled analytics rule using a KQL query that joins both tables✓
• CA workbook
• DA watchlist

Answer: A scheduled analytics rule runs a KQL query, which can join multiple tables such as sign-in and firewall logs, and generates alerts and incidents when the pattern matches. Workbooks visualise but do not generate incidents from custom logic.

You want to ensure that activity logs and resource logs from all subscriptions are continuously sent to a central Log Analytics workspace for the SOC, enforced automatically on new resources. Which approach scales best?

• AAssign Azure Policy with DeployIfNotExists to configure diagnostic settings to the central workspace✓
• BManually add a diagnostic setting to every resource as it is created, and review the full list each month
• CUse NSG flow logs alone, which record network traffic and contain no control-plane or resource events
• DEmail the logs to the security operations centre daily

Answer: Azure Policy with the DeployIfNotExists effect can automatically configure diagnostic settings on resources to send logs to the central workspace, including remediating existing and new resources at scale. Manual per-resource configuration does not scale.

A regulatory standard must be tracked against your environment with automated control assessments and a compliance score. Which Microsoft Defender for Cloud feature provides this?

• ANSG flow logs
• BThe regulatory compliance dashboard with compliance standards✓
• CA resource lock
• DThe Network Watcher topology diagram view

Answer: The regulatory compliance dashboard in Microsoft Defender for Cloud maps built-in and custom standards to controls and continuously assesses your resources, producing a compliance posture. Network Watcher and locks do not assess compliance standards.

You want to suppress noisy, low-value security alerts in Microsoft Defender for Cloud that are known false positives for a particular resource group, without disabling the underlying detection elsewhere. Which feature should you use?

• ADisable Defender for Cloud
• BDelete the resource group
• CAlert suppression rules✓
• DA route table

Answer: Alert suppression rules let you define conditions, such as a specific resource group or alert type, to automatically dismiss matching alerts while the detection continues elsewhere. Disabling Defender for Cloud would remove protection broadly.

To investigate the full scope of a multi-stage attack in Microsoft Sentinel, an analyst wants alerts automatically grouped and mapped to attacker tactics. Which Sentinel capability correlates lower-fidelity alerts into higher-fidelity incidents using machine learning?

• AData connectors
• BWorkbooks
• CFusion analytics✓
• DWatchlists

Answer: Fusion is a correlation engine in Sentinel that uses machine learning to combine multiple lower-fidelity alerts across products into high-fidelity multistage attack incidents. Workbooks and watchlists do not perform this correlation.

You need to ensure Sentinel ingests only relevant security events from servers to control cost, filtering out verbose noise at collection time. Which mechanism provides collection-time filtering?

• AIncreasing the workspace retention period
• BA resource lock
• CData collection rules with transformations✓
• DA storage firewall

Answer: Data collection rules, including ingestion-time transformations, let you filter and shape incoming data so only relevant events are stored, reducing volume and cost. Retention settings affect how long data is kept, not what is collected.

After a Sentinel incident is created, you want an analyst-driven action that runs a playbook on demand to isolate a host. How can an analyst trigger a playbook for a specific incident manually?

• ABy changing retention
• BBy running the playbook from the incident's actions, or via an automation rule✓
• CBy adding a route
• DBy editing one of the workbooks attached to the incident

Answer: Analysts can run a playbook manually from an incident's actions, and automation rules can also invoke playbooks automatically; both allow response actions such as host isolation. Workbooks and retention settings do not execute response actions.

You want to identify which Azure resources are most exposed and obtain a prioritised list of remediation steps that would most improve your security posture. Which Defender for Cloud feature provides this prioritisation?

• ANSG flow logs written to a storage account for later traffic analysis
• BA resource lock
• CSecure score recommendations✓
• DA budget alert raised when subscription spending passes a threshold

Answer: Secure score aggregates security recommendations and quantifies their impact, giving a prioritised list of actions that most improve posture when remediated. Flow logs and budget alerts do not prioritise posture improvements.

A custom application emits security-relevant logs to a file on a VM. To bring these into Log Analytics for Sentinel analytics, which agent and configuration should you use?

• AAn agent is unnecessary, because Azure collects application log files from the virtual machine automatically
• BA storage account SAS handed to the application so it can upload its own log files to a container
• CA route table directing the virtual machine's traffic towards the Log Analytics workspace
• DThe Azure Monitor Agent with a custom text-log data collection rule✓

Answer: The Azure Monitor Agent, configured with a data collection rule for custom text logs, collects application log files from the VM into Log Analytics where Sentinel can analyse them. Custom file logs require an agent and a collection rule.

You must ensure that a critical Defender for Cloud recommendation is automatically remediated, for example enabling secure transfer on storage accounts, without manual clicks. Which capability provides one-click or automated remediation?

• AA watchlist
• BA workbook
• CQuick fix or governance rules with automated remediation in Defender for Cloud✓
• DA NAT gateway associated with each of the affected subnets

Answer: Many Defender for Cloud recommendations offer a quick fix, and governance rules can drive automated remediation and accountability for owners, reducing manual effort. Workbooks and watchlists are not remediation mechanisms.

Your SOC wants near-real-time detection that a user was added to a privileged Microsoft Entra role, generating an incident. Which Sentinel artefact should you create?

• AA NAT rule
• BA storage lifecycle policy that archives the audit log export after a set number of days
• CAn analytics rule on the audit logs detecting role addition events✓
• DA workbook tile

Answer: An analytics rule querying the Microsoft Entra audit logs for the add-member-to-role operation can generate an alert and incident when a privileged role assignment occurs. Workbooks only visualise and do not raise incidents.

To enrich Sentinel incidents with reputation data so analysts immediately know if an IP is a known malicious indicator, which data type should you ingest?

• AThreat intelligence indicators via the threat intelligence connector✓
• BTopology data describing how the virtual networks and subnets connect to one another
• CCost data broken down by subscription, resource group and individual resource
• DScheduled billing exports delivered to a storage account for the finance team

Answer: Ingesting threat intelligence indicators through the threat intelligence connectors lets analytics rules match observed entities against known malicious indicators and enrich incidents. Cost and billing data do not provide reputation context.

You need to retain security logs cheaply for two years but only query the last 90 days interactively, restoring older data when needed for investigations. Which Log Analytics capability fits?

• AA resource lock
• BA NAT gateway
• CInteractive retention plus archive tier with search jobs or restore✓
• DDelete all of the logs once 90 days have passed

Answer: Configuring interactive retention for recent data and the archive tier for older data, then using search jobs or restore when older data is needed, balances cost and investigative access. Deleting after 90 days would violate the retention requirement.

A SOC analyst needs a dashboard visualising sign-in failures, risky users, and firewall denies from data already in the workspace. Which Sentinel feature should they build?

• AA data connector
• BA NAT rule
• CA stored access policy
• DA workbook✓

Answer: Workbooks provide interactive visualisations and dashboards over data already in the workspace, ideal for presenting sign-in failures, risky users, and firewall denies. Data connectors ingest data but do not visualise it.

To detect anomalous DNS queries indicative of data exfiltration or malware command-and-control from Azure resources, which Defender for Cloud plan should you enable?

• AMicrosoft Defender for Resource Manager
• BMicrosoft Defender for DNS✓
• CMicrosoft Defender for Storage
• DMicrosoft Defender for SQL

Answer: Microsoft Defender for DNS analyses DNS queries from Azure resources to detect suspicious activity such as data exfiltration via DNS, domain generation algorithms, and communication with malicious domains. The other plans protect different workloads.

You want incidents from Microsoft Defender XDR and Microsoft Sentinel managed in a single unified queue. Which capability provides this consolidated experience?

• AThe unified security operations platform integrating Sentinel with Defender XDR in the Defender portal✓
• BA route table
• CKeeping the two products in separate portals and having analysts triage each queue in turn during a shift
• DNSG flow logs

Answer: Microsoft's unified security operations platform brings Microsoft Sentinel and Defender XDR together in the Microsoft Defender portal, providing a single incident queue and shared investigation experience. Flow logs and routes are unrelated.

An analyst needs to preserve a specific log record found during a hunt so the team can return to it and attach it to an incident later. Which Sentinel feature should they use?

• AA diagnostic setting
• BA storage firewall
• CA NAT rule
• DA hunting bookmark✓

Answer: Hunting bookmarks let analysts save interesting query results, annotate them, and later promote them to incidents or attach them for collaboration. Diagnostic settings and network controls do not preserve hunt findings.

You must ensure that when Defender for Cloud raises a high-severity alert, an email is sent to the security team and a ticket is created automatically. Which combination achieves automated response?

• AA resource lock preventing the affected resource from being deleted while the alert is open
• BDefender for Cloud workflow automation triggering a Logic App✓
• CA stored access policy on the container that holds the exported alert data
• DA route table sending the alerting subnet's traffic through a virtual appliance

Answer: Workflow automation in Defender for Cloud can trigger a Logic App on alerts or recommendations to send notifications and create tickets, implementing automated response. Resource locks and routes do not respond to alerts.

To measure mean time to acknowledge and resolve incidents in Microsoft Sentinel for SOC reporting, which approach uses the platform's own data?

• AQuery the SecurityIncident table or use the security operations efficiency workbook✓
• BCheck the storage account firewall settings in the portal
• CRead NSG flow logs
• DGuess from memory

Answer: The SecurityIncident table and the built-in security operations efficiency workbook expose incident lifecycle timestamps so you can calculate metrics like mean time to acknowledge and resolve. Flow logs and firewalls hold no incident metrics.

You need to ensure that Sentinel analytics rules cover the relevant attacker techniques and identify coverage gaps mapped to a recognised framework. Which Sentinel feature provides this mapping?

• AA resource lock
• BA storage lifecycle policy for the exported detection data
• CThe MITRE ATT&CK coverage view✓
• DA NAT rule

Answer: Sentinel's MITRE ATT&CK view maps your active analytics rules and detections to tactics and techniques, highlighting coverage and gaps. Routes, lifecycle policies, and locks have no relation to detection coverage.

A subscription owner wants assurance that any newly created VM is automatically onboarded to Defender for Servers protection. How is automatic onboarding ensured?

• AAdd a route table to each virtual machine subnet so its traffic reaches the Defender for Cloud service
• BEnable NSG flow logs on every subnet so that any new machine appears in the traffic records automatically
• CEnable the Defender for Servers plan at the subscription so new resources are covered automatically✓
• DManually enable the plan on each virtual machine once the build team has confirmed it has been created

Answer: Enabling a Microsoft Defender for Cloud plan such as Defender for Servers at the subscription scope automatically extends protection to existing and newly created resources of that type. Manual per-VM enablement does not guarantee coverage of new resources.