A company uses Microsoft Defender for Cloud Apps to monitor shadow IT. The security team wants to receive alerts for risky user activities and also be able to investigate the user's other activities across Microsoft 365. What is the best way to achieve this?

Use the Defender for Cloud Apps portal's built-in investigation tools.

Connect Defender for Cloud Apps to Microsoft Sentinel and use the unified incident investigation.

Export Defender for Cloud Apps logs to Azure Storage and analyze them with Power BI.

Set up a conditional access policy to block risky apps.

An organization wants to use Microsoft Sentinel to automatically respond to a high-severity alert generated by Microsoft Defender for Cloud. The response must run a custom script on the affected VM. What should they configure in Sentinel?

A workbook that includes a run script button

A scheduled analytics rule that runs the script

A data connector that forwards the alert to a function app

An automation rule that triggers a playbook

A SOC team wants to use Microsoft Sentinel to automatically respond to low-severity incidents by closing them and sending a notification to the analyst on duty. They do not want to create a full playbook for this simple task. What is the most efficient way to achieve this?

Use a workbook to display the incidents and manually close them.

Create an automation rule in Sentinel that closes the incident and sends a notification via a webhook.

Configure a Microsoft 365 Defender automation rule to close the incident.

Create a playbook in Azure Logic Apps that closes the incident and sends an email.

An organization has Microsoft Defender for Cloud enabled and Microsoft Sentinel deployed. They want to automatically create an incident in Sentinel when Defender for Cloud detects a vulnerability on a virtual machine. What should they configure?

A diagnostic setting on the VM to send logs directly to Sentinel

A playbook in Sentinel that queries Defender for Cloud APIs on a schedule

A data connector that streams Defender for Cloud alerts into Sentinel

An automation rule in Defender for Cloud that sends email to the SOC

GIAC Certified Detection Analyst

Domain 2Objective 2

Defender and Sentinel Overview GCDA Practice Questions (Page 2)

Part of the Cloud and Microsoft Security Analytics domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

3concepts

Questions 6–10

6application · medium
A company uses Microsoft Defender for Cloud Apps to monitor shadow IT. The security team wants to receive alerts for risky user activities and also be able to investigate the user's other activities across Microsoft 365. What is the best way to achieve this?
Select an answer first
7application · medium
An organization uses Microsoft Defender for Cloud to monitor its Azure resources. The security team wants to see which security recommendations are not yet implemented and prioritize them by potential impact. Which Defender for Cloud page should they review?
Select an answer first
8application · medium
An organization wants to use Microsoft Sentinel to automatically respond to a high-severity alert generated by Microsoft Defender for Cloud. The response must run a custom script on the affected VM. What should they configure in Sentinel?
Select an answer first
9application · medium
A SOC team wants to use Microsoft Sentinel to automatically respond to low-severity incidents by closing them and sending a notification to the analyst on duty. They do not want to create a full playbook for this simple task. What is the most efficient way to achieve this?
Select an answer first
10application · medium
An organization has Microsoft Defender for Cloud enabled and Microsoft Sentinel deployed. They want to automatically create an incident in Sentinel when Defender for Cloud detects a vulnerability on a virtual machine. What should they configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.