An organization uses Defender for Cloud to monitor its Azure resources. They want to ensure that security alerts are available to the SOC team even if Sentinel is temporarily unavailable. What should they do?

Disable Sentinel and use only Defender for Cloud

Create a second Sentinel workspace in another region

Rely on Defender for Cloud's native alert viewing and export capabilities

Use Sentinel's built-in redundancy features

A company uses Microsoft Defender for Cloud to protect its Azure VMs. The security team wants to receive alerts about suspicious activities on those VMs and also have the ability to investigate the full attack chain across the entire Microsoft 365 environment. What is the recommended approach?

Deploy Microsoft Defender for Endpoint on the VMs and use the Microsoft 365 Defender portal for investigation.

Configure Azure Monitor alerts for VM activity and use the Azure portal's activity log.

Use only Defender for Cloud's built-in security alerts and its integration with Azure Advisor.

Enable Defender for Cloud alerts and connect them to Microsoft Sentinel for cross-domain investigation.

A security analyst at a company using Microsoft 365 Defender notices that a user's device was flagged by Microsoft Defender for Endpoint for a suspicious PowerShell command. The analyst wants to correlate this alert with authentication events from Azure AD and investigate the user's mailbox activity in the same console. Which approach best meets the requirement?

Manually export the PowerShell alert from Defender for Endpoint and import it into Azure Sentinel for correlation with Azure AD sign-in logs.

Enable Azure AD Identity Protection and check the user's risk report to find the PowerShell alert.

Use Microsoft Defender for Cloud Apps to view the PowerShell alert and then switch to Azure AD sign-in logs separately.

Open the Microsoft 365 Defender portal and use the unified incident view to see related alerts and entities across endpoint, identity, and email.

Which Microsoft Defender product is specifically designed to protect endpoints (including Windows, macOS, Linux, Android, and iOS) from threats?

Microsoft Defender for Endpoint

Microsoft Defender for Identity

Microsoft Defender for Office 365

A security team wants to use Sentinel to automate response to phishing emails reported by users. They have Microsoft Defender for Office 365 and Sentinel connected. The desired response is to delete the email from all mailboxes and block the sender. What should they build?

A playbook that uses Defender for Office 365 actions to delete and block

A data connector that deletes emails

An analytics rule that deletes emails

A workbook with a delete button

GIAC Certified Detection Analyst

Domain 2Objective 2

Defender and Sentinel Overview GCDA Practice Questions (Page 5)

Part of the Cloud and Microsoft Security Analytics domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

3concepts

Questions 21–25

21expert · hard
An organization uses Defender for Cloud to monitor its Azure resources. They want to ensure that security alerts are available to the SOC team even if Sentinel is temporarily unavailable. What should they do?
Select an answer first
22application · medium
A company uses Microsoft Defender for Cloud to protect its Azure VMs. The security team wants to receive alerts about suspicious activities on those VMs and also have the ability to investigate the full attack chain across the entire Microsoft 365 environment. What is the recommended approach?
Select an answer first
23application · medium
A security analyst at a company using Microsoft 365 Defender notices that a user's device was flagged by Microsoft Defender for Endpoint for a suspicious PowerShell command. The analyst wants to correlate this alert with authentication events from Azure AD and investigate the user's mailbox activity in the same console. Which approach best meets the requirement?
Select an answer first
24foundation · easy
Which Microsoft Defender product is specifically designed to protect endpoints (including Windows, macOS, Linux, Android, and iOS) from threats?
Select an answer first
25expert · hard
A security team wants to use Sentinel to automate response to phishing emails reported by users. They have Microsoft Defender for Office 365 and Sentinel connected. The desired response is to delete the email from all mailboxes and block the sender. What should they build?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.