A large enterprise uses Microsoft Defender for Endpoint, Defender for Identity, and Microsoft Sentinel. The security team wants to reduce alert fatigue by correlating alerts from these products into a single incident. They also need to ensure that the incident investigation includes the full attack chain across all sources. What is the best approach?

Enable the Microsoft 365 Defender data connector in Sentinel and use the unified incident view in Microsoft 365 Defender.

Use Sentinel playbooks to correlate alerts from each product and create a single incident.

Create separate analytics rules in Sentinel for each product and manually merge related incidents.

Configure Defender for Endpoint to send alerts directly to Sentinel and disable Defender for Identity alerts.

A security team wants to use Microsoft Sentinel to detect a specific attack pattern that involves multiple failed logins followed by a successful login from a different country. They need to create a custom detection. What should they create in Sentinel?

An analytics rule with a KQL query

A data connector for sign-in logs

A workbook that visualizes sign-in logs

A playbook that queries sign-in logs

A security team is evaluating whether to use Microsoft Sentinel for a small environment with limited budget. They need basic log collection, alerting, and a simple automated response. They already have Microsoft 365 Defender. What is the most cost-effective approach among the listed options?

Use a third-party SIEM instead of Sentinel

Use Microsoft 365 Defender's built-in alerting and automated investigation capabilities

Deploy Sentinel with all data connectors enabled

Use Sentinel with only the Microsoft 365 Defender connector

A company has Microsoft Defender for Cloud enabled on its Azure subscription. They want to receive a consolidated view of security alerts from both Azure VMs and on-premises servers in a single dashboard. What should they do?

Create a custom dashboard in Azure Monitor for on-premises servers

Onboard the on-premises servers to Defender for Cloud and use the Defender for Cloud dashboard

Use Microsoft Defender for Endpoint to monitor on-premises servers only

Deploy Microsoft Sentinel and connect only the Azure VMs

An organization has Defender for Cloud's Defender plans enabled for servers, but they are concerned about the cost of monitoring a large number of low-priority development VMs. They want to maintain security monitoring for production VMs while reducing costs for development VMs. What should they do?

Use Azure Policy to exclude development VMs from Defender for Cloud

Disable the Defender for Servers plan for the development subscription and keep it enabled for the production subscription

Turn off Defender for Cloud for all subscriptions and rely on Sentinel

Use a single subscription for all VMs and set a budget alert

GIAC Certified Detection Analyst

Domain 2Objective 2

Defender and Sentinel Overview GCDA Practice Questions (Page 1)

Part of the Cloud and Microsoft Security Analytics domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

3concepts

Questions 1–5

1expert · hard
A large enterprise uses Microsoft Defender for Endpoint, Defender for Identity, and Microsoft Sentinel. The security team wants to reduce alert fatigue by correlating alerts from these products into a single incident. They also need to ensure that the incident investigation includes the full attack chain across all sources. What is the best approach?
Select an answer first
2application · medium
A security team wants to use Microsoft Sentinel to detect a specific attack pattern that involves multiple failed logins followed by a successful login from a different country. They need to create a custom detection. What should they create in Sentinel?
Select an answer first
3expert · hard
A security team is evaluating whether to use Microsoft Sentinel for a small environment with limited budget. They need basic log collection, alerting, and a simple automated response. They already have Microsoft 365 Defender. What is the most cost-effective approach among the listed options?
Select an answer first
4application · medium
A company has Microsoft Defender for Cloud enabled on its Azure subscription. They want to receive a consolidated view of security alerts from both Azure VMs and on-premises servers in a single dashboard. What should they do?
Select an answer first
5expert · hard
An organization has Defender for Cloud's Defender plans enabled for servers, but they are concerned about the cost of monitoring a large number of low-priority development VMs. They want to maintain security monitoring for production VMs while reducing costs for development VMs. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.

Defender and Sentinel Overview GCDA Practice Questions (Page 1)

Questions 1–5

A security team wants to use Microsoft Sentinel to detect a specific attack pattern that involves multiple failed logins followed by a successful login from a different country. They need to create a custom detection. What should they create in Sentinel?

A security team is evaluating whether to use Microsoft Sentinel for a small environment with limited budget. They need basic log collection, alerting, and a simple automated response. They already have Microsoft 365 Defender. What is the most cost-effective approach among the listed options?

A company has Microsoft Defender for Cloud enabled on its Azure subscription. They want to receive a consolidated view of security alerts from both Azure VMs and on-premises servers in a single dashboard. What should they do?

Keep studying — Cloud and Microsoft Security Analytics