A security team is deploying Microsoft Sentinel and must decide how to handle data from multiple regions. They have offices in the US and Europe, and data residency requirements mandate that European data remain in Europe. They also want to minimize cross-region data transfer costs. What should they do?

Deploy a single Sentinel workspace in the US and use Azure ExpressRoute for data transfer

Use Azure Lighthouse to manage a single workspace from multiple regions

Deploy separate Sentinel workspaces in each region and configure data connectors accordingly

Deploy a single Sentinel workspace in Europe and stream US data there

A security team is planning to deploy Microsoft Sentinel for a multi-cloud environment. They need to ingest logs from AWS, Azure, and on-premises sources. They also want to minimize the cost of data ingestion while retaining the ability to run complex queries. What should they consider?

Use Azure Monitor to collect all logs and then export them to Sentinel.

Use Sentinel's built-in connectors for AWS and Azure, and configure log retention tiers to balance cost and query needs.

Deploy Sentinel in each cloud and manually aggregate incidents.

Ingest all logs into a single Log Analytics workspace with default retention settings.

A security operations team uses Microsoft Defender for Cloud to monitor a hybrid environment and wants to centralize alerts from all sources into a single analytics workspace. They also need to run custom KQL queries and create automated response playbooks. Which solution should they deploy?

Microsoft Defender for Identity

Microsoft Defender for Office 365

Microsoft Defender for Endpoint

A SOC team wants to use Microsoft Sentinel to track the status of incidents and ensure they are assigned to the correct analysts. They also want to automate the assignment based on the incident type. What is the most efficient way to achieve this?

Use a workbook to track incident assignments and manually update them.

Use Sentinel automation rules to assign incidents to specific owners based on conditions.

Configure Microsoft 365 Defender to assign incidents to analysts.

Create a playbook that assigns the incident to an analyst using a manual approval step.

GIAC Certified Detection Analyst

Domain 2Objective 2

Defender and Sentinel Overview GCDA Practice Questions (Page 3)

Part of the Cloud and Microsoft Security Analytics domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

3concepts

Questions 11–15

11expert · hard
A security team is deploying Microsoft Sentinel and must decide how to handle data from multiple regions. They have offices in the US and Europe, and data residency requirements mandate that European data remain in Europe. They also want to minimize cross-region data transfer costs. What should they do?
Select an answer first
12expert · hard
A security team is planning to deploy Microsoft Sentinel for a multi-cloud environment. They need to ingest logs from AWS, Azure, and on-premises sources. They also want to minimize the cost of data ingestion while retaining the ability to run complex queries. What should they consider?
Select an answer first
13application · medium
A security analyst needs to investigate a series of suspicious sign-ins across multiple cloud applications. They want to use a single query language to correlate sign-in logs with threat intelligence and other data sources. Which Sentinel feature should they use?
Select an answer first
14application · medium
A security operations team uses Microsoft Defender for Cloud to monitor a hybrid environment and wants to centralize alerts from all sources into a single analytics workspace. They also need to run custom KQL queries and create automated response playbooks. Which solution should they deploy?
Select an answer first
15application · medium
A SOC team wants to use Microsoft Sentinel to track the status of incidents and ensure they are assigned to the correct analysts. They also want to automate the assignment based on the incident type. What is the most efficient way to achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.

Defender and Sentinel Overview GCDA Practice Questions (Page 3)

Questions 11–15

A security team is planning to deploy Microsoft Sentinel for a multi-cloud environment. They need to ingest logs from AWS, Azure, and on-premises sources. They also want to minimize the cost of data ingestion while retaining the ability to run complex queries. What should they consider?

A security analyst needs to investigate a series of suspicious sign-ins across multiple cloud applications. They want to use a single query language to correlate sign-in logs with threat intelligence and other data sources. Which Sentinel feature should they use?

A security operations team uses Microsoft Defender for Cloud to monitor a hybrid environment and wants to centralize alerts from all sources into a single analytics workspace. They also need to run custom KQL queries and create automated response playbooks. Which solution should they deploy?

A SOC team wants to use Microsoft Sentinel to track the status of incidents and ensure they are assigned to the correct analysts. They also want to automate the assignment based on the incident type. What is the most efficient way to achieve this?

Keep studying — Cloud and Microsoft Security Analytics