Microsoft Sentinel & Defender XDR

What does the term SIEM refer to in Microsoft Sentinel?

• AA system for managing employee identities and their passwords
• BA service for encrypting files stored in the cloud at rest
• CSecurity information and event management, collecting and analyzing security data✓
• DA tool for measuring the raw speed, and latency, of the corporate network links

Answer: SIEM stands for security information and event management: collecting logs and events from across the estate and analyzing them to detect threats. Sentinel is Microsoft's cloud-native SIEM, not an identity, encryption or network-speed tool.

What does the SOAR capability in Microsoft Sentinel add beyond detection?

• AAutomated, orchestrated response to incidents using playbooks✓
• BAutomatic encryption of the logs that are collected into the workspace
• CPhysical isolation of the data center where the workspace is hosted
• DCollection of log data from connected sources using data connectors

Answer: SOAR (security orchestration, automation and response) lets Sentinel respond to incidents automatically through playbooks, reducing manual effort. Collecting data through connectors is the SIEM side of Sentinel; SOAR does not encrypt logs or isolate data centers.

What is Microsoft Defender XDR?

• AA single antivirus engine that only scans one Windows device
• BA unified suite that correlates threat signals across email, endpoints, identities and apps✓
• CA billing tool for tracking the cost of Microsoft 365 licenses
• DA service for building, hosting and running the organization's own custom web applications in the cloud

Answer: Microsoft Defender XDR unifies detection and response across domains such as email, endpoints, identities and cloud apps, correlating signals into incidents. It is far more than a single-device antivirus and is not a billing or hosting tool.

Which Microsoft Defender XDR service protects against threats in email and collaboration tools?

• AMicrosoft Defender for Endpoint
• BMicrosoft Defender for Office 365✓
• CMicrosoft Defender for Identity
• DMicrosoft Defender for Cloud Apps

Answer: Defender for Office 365 protects against threats such as phishing and malicious links in email and collaboration tools. Defender for Endpoint protects devices, Defender for Identity protects on-premises identities, and Defender for Cloud Apps protects SaaS usage.

What does Microsoft Defender for Endpoint primarily protect?

• ADevices such as laptops, desktops and servers against threats✓
• BEmail messages that arrive into the users' mailboxes from outside the organization over the internet
• CCloud storage accounts against accidental public exposure
• DThe physical door and gate entry access to all of the organization's offices and other buildings

Answer: Defender for Endpoint is an endpoint detection and response solution that protects devices like PCs and servers. Email, cloud storage exposure and physical access are handled by other tools.

What does Microsoft Defender for Cloud Apps provide?

• AVisibility and control over the cloud apps and services people use (a CASB)✓
• BA firewall that filters traffic between two on-premises sites
• CA password manager for storing personal account credentials
• DA tool for visually designing and laying out the pages of a corporate marketing website

Answer: Defender for Cloud Apps is a cloud access security broker (CASB) that discovers cloud app usage and applies controls and threat protection to SaaS apps. It is not a site-to-site firewall, password manager or web-design tool.

What is the focus of Microsoft Defender for Identity?

• ADetecting identity-based threats using signals from on-premises Active Directory✓
• BEncrypting the hard drives of laptops used in the organization
• CBlocking spam and phishing email messages before they reach users' Outlook email inboxes
• DScanning websites for broken links and slow-loading pages

Answer: Defender for Identity uses signals from on-premises Active Directory to detect identity-based attacks such as compromised accounts and lateral movement. Disk encryption, spam filtering and website scanning are unrelated.

Where can a security analyst view and investigate incidents across Microsoft Defender XDR?

• AIn the Microsoft Purview compliance portal
• BIn the Microsoft Defender portal✓
• CIn the Azure Cost Management dashboard
• DIn the Microsoft Entra admin center only

Answer: The Microsoft Defender portal is the unified place to view and investigate incidents and alerts across Defender XDR. Purview handles compliance, Cost Management handles spend, and the Entra admin center handles identity.

What does threat intelligence in the Microsoft Defender portal (formerly Microsoft Defender Threat Intelligence) provide?

• AA nightly backup copy of the organization's user mailboxes and shared files
• BInformation about threats, threat actors and indicators to inform defense✓
• CA way to assign sensitivity labels to confidential documents
• DA detailed record of each user's sign-in locations over the past twelve months

Answer: Threat intelligence in the Microsoft Defender portal delivers curated information on threats, actors, tools and indicators of compromise to help defenders understand and respond to threats. It brings together what was sold separately as Microsoft Defender Threat Intelligence. It is not a backup, labeling or sign-in-log feature.

What does Microsoft Defender Vulnerability Management help an organization do?

• ADiscover and prioritize vulnerabilities and misconfigurations on devices✓
• BDeliver large marketing email campaigns out to all of the organization's existing paying customers
• CEncrypt network traffic between the branch offices and the cloud
• DProvision brand-new user accounts automatically whenever new employees first join the company today

Answer: Defender Vulnerability Management continuously discovers, assesses and prioritizes vulnerabilities and misconfigurations so they can be remediated by risk. It is not a marketing, VPN or provisioning tool.

Which statement best distinguishes Microsoft Sentinel from Microsoft Defender XDR?

• ASentinel protects only inbound email messages, while Microsoft Defender XDR protects only the corporate network perimeter and nothing else
• BSentinel and Defender XDR are two names for the same product, with no real difference between them
• CSentinel manages user passwords and sign-ins, while Defender XDR manages the device drivers on computers
• DSentinel is a broad SIEM for data across many sources, while Defender XDR is focused XDR across Microsoft workloads✓

Answer: Sentinel is a scalable, cloud-native SIEM and SOAR that ingests data from many Microsoft and non-Microsoft sources, while Defender XDR delivers extended detection and response focused on Microsoft workloads such as email, endpoints and identities; they work together. The other statements are inaccurate.