An organization uses Microsoft Defender for Endpoint and Microsoft Sentinel. The security team wants to enrich Sentinel incidents with the full device timeline from Defender for Endpoint when an incident is created. What is the recommended approach?

Create a playbook that calls the Defender for Endpoint API to fetch the device timeline and add it to the incident.

Use the Defender for Endpoint data connector in Sentinel to ingest device timeline events into the workspace.

Use a workbook in Sentinel to display the device timeline from Defender for Endpoint.

Manually copy the device timeline from the Defender for Endpoint portal into Sentinel.

A company wants to protect its Azure SQL databases and storage accounts from threats. They also want to centralize the security alerts from these resources in a single dashboard. Which Microsoft Defender product should they use?

Microsoft Defender for Identity

Microsoft Defender for Endpoint

Microsoft Defender for Office 365

A company uses Microsoft Defender for Cloud to assess the security posture of its Azure subscriptions. The security team wants to view a unified score that reflects the implementation of recommended security controls across all subscriptions. Which Defender for Cloud feature should they use?

Microsoft Defender for Endpoint

A security operations center (SOC) wants to use Microsoft Sentinel to detect a known attack pattern that involves multiple data sources, such as Azure AD sign-ins, AWS CloudTrail, and endpoint events. They need to create a custom detection that triggers an incident when the pattern is observed. What should they do?

Use a playbook to query each data source separately and manually create an incident.

Configure a Microsoft 365 Defender incident creation rule to detect the pattern.

Create a scheduled analytics rule with a KQL query that joins data from the relevant tables.

Set up a workbook in Sentinel to visualize the data and manually create incidents.

A security team is deploying Microsoft Sentinel and needs to ensure that sensitive data, such as usernames and IP addresses, is not exposed to all analysts. They want to restrict access to specific tables and columns while still allowing the SOC to perform investigations. What should they do?

Use Azure RBAC to grant specific roles and use table-level and column-level permissions in the Log Analytics workspace.

Enable Azure AD Privileged Identity Management to control access to Sentinel.

Create separate Sentinel workspaces for each team to isolate data.

Use a playbook to filter sensitive data before ingestion.

GIAC Certified Detection Analyst

Domain 2Objective 2

Defender and Sentinel Overview GCDA Practice Questions (Page 4)

Part of the Cloud and Microsoft Security Analytics domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

3concepts

Questions 16–20

16application · medium
An organization uses Microsoft Defender for Endpoint and Microsoft Sentinel. The security team wants to enrich Sentinel incidents with the full device timeline from Defender for Endpoint when an incident is created. What is the recommended approach?
Select an answer first
17application · medium
A company wants to protect its Azure SQL databases and storage accounts from threats. They also want to centralize the security alerts from these resources in a single dashboard. Which Microsoft Defender product should they use?
Select an answer first
18application · medium
A company uses Microsoft Defender for Cloud to assess the security posture of its Azure subscriptions. The security team wants to view a unified score that reflects the implementation of recommended security controls across all subscriptions. Which Defender for Cloud feature should they use?
Select an answer first
19application · medium
A security operations center (SOC) wants to use Microsoft Sentinel to detect a known attack pattern that involves multiple data sources, such as Azure AD sign-ins, AWS CloudTrail, and endpoint events. They need to create a custom detection that triggers an incident when the pattern is observed. What should they do?
Select an answer first
20expert · hard
A security team is deploying Microsoft Sentinel and needs to ensure that sensitive data, such as usernames and IP addresses, is not exposed to all analysts. They want to restrict access to specific tables and columns while still allowing the SOC to perform investigations. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.