Defender and Sentinel Overview GCDA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A SOC team is using Sentinel with Defender for Cloud alerts. They notice that some Defender for Cloud alerts are not appearing in Sentinel incidents. They have enabled the data connector and analytics rules. What is the most likely cause?

   • AThe alerts are too old to be ingested
   • BThe Defender for Cloud plan is disabled for the subscription
   • CThe alerts are being filtered by the analytics rule's query or incident creation settings
   • DSentinel is in a different region than Defender for Cloud
   Reveal Solution Discussion Select an answer first
2. 27expert · hard · select all that apply

   A security team wants to implement a comprehensive detection and response strategy using Microsoft Defender and Sentinel. They need to cover identity, endpoint, email, and cloud workloads. Select all the Microsoft Defender products that should be integrated with Sentinel to achieve this coverage.

   • AMicrosoft Azure Active Directory (now Microsoft Entra ID)
   • BMicrosoft Defender for Office 365
   • CMicrosoft Defender for Endpoint
   • DMicrosoft Defender for Cloud
   • EMicrosoft Defender for Identity
   Check answers Discussion Select an answer first
4. 28application · medium

   An organization uses Microsoft Defender for Identity and Microsoft Sentinel. The security team wants to automatically disable a user account in Azure AD when Sentinel detects a suspicious identity-based attack. What is the recommended way to achieve this?

   • ASet up an automation rule in Microsoft 365 Defender to disable the user.
   • BUse a conditional access policy in Azure AD to block the user when the attack is detected.
   • CCreate a Sentinel playbook that uses an Azure AD action to disable the user when an incident is triggered.
   • DConfigure Defender for Identity to automatically disable the user account when it detects the attack.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization uses Microsoft Defender for Office 365 and Microsoft Sentinel. The security team wants to automatically create an incident in Sentinel whenever a high-severity phishing alert is generated in Defender for Office 365. What should they configure?

   • AConfigure a mail flow rule in Exchange Online to forward phishing alerts to Sentinel's ingestion endpoint.
   • BEnable the Microsoft Defender for Office 365 data connector in Sentinel and create an analytics rule that triggers on the alert data.
   • CUse a logic app in Azure to poll Defender for Office 365 API and manually create incidents in Sentinel.
   • DSet up a playbook in Defender for Office 365 that sends an email to the SOC when a phishing alert is raised.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   In a cloud security context, which statement best describes the role of Microsoft Defender for Cloud?

   • AIt is a network firewall that filters traffic between virtual networks and on-premises networks.
   • BIt is a cloud-native SIEM that ingests logs from multiple sources and provides advanced hunting queries.
   • CIt is a threat intelligence feed that only provides raw indicators of compromise for third-party SIEMs.
   • DIt is a unified infrastructure security platform that provides cloud security posture management and workload protection across multicloud and hybrid environments.
   Reveal Solution Discussion Select an answer first