A security analyst needs to create a visual dashboard that shows the geographic distribution of sign-in failures over the past 30 days. They have already ingested sign-in logs into Microsoft Sentinel. What should they use?

An analytics rule with a map query

A workbook with a map visualization

A large enterprise has Microsoft Defender for Cloud and Microsoft Sentinel deployed. The SOC wants to reduce alert fatigue by automatically closing low-confidence alerts from Defender for Cloud that are also detected by Defender for Endpoint. They want to keep high-confidence alerts for manual review. What is the most effective approach?

Create a playbook that closes all Defender for Cloud alerts

Use a workbook to filter out low-confidence alerts from the dashboard

Create a Sentinel analytics rule that correlates Defender for Cloud and Defender for Endpoint alerts and auto-close low-confidence incidents

Disable low-confidence alerts in Defender for Cloud

A security analyst needs to search across all ingested logs in Microsoft Sentinel for a specific IP address that appeared in firewall logs, Azure AD sign-ins, and endpoint events. What should they use?

Use the Microsoft 365 Defender advanced hunting to search the IP address.

Run a KQL query in the Sentinel Logs page that searches across the relevant tables.

Create a new analytics rule to search for the IP address.

Use the Sentinel workbook gallery to find the IP address.

A SOC team wants to use Microsoft Sentinel as its single platform for incident management. They currently receive alerts from Microsoft Defender for Cloud and Microsoft Defender for Endpoint. What is the most efficient way to bring these alerts into Sentinel?

Manually export alerts as CSV and upload to Sentinel

Create custom KQL queries to pull alerts from each product

Enable the respective data connectors for Defender for Cloud and Defender for Endpoint

Use Azure Monitor diagnostic settings on each product

A company wants to consolidate security alerts from on-premises firewalls, AWS CloudTrail, and Microsoft 365 Defender into a single analytics platform. They also need to run custom KQL queries and set up automated response playbooks. Which solution should they choose?

Microsoft 365 Defender portal with custom detections and automated investigations.

Azure Monitor with Log Analytics workspaces and action groups.

Microsoft Defender for Cloud with regulatory compliance dashboard and Azure Policy.

Microsoft Sentinel with data connectors for each source and automation rules using playbooks.

GIAC Certified Detection Analyst

Domain 2Objective 2

Defender and Sentinel Overview GCDA Practice Questions (Page 7)

Part of the Cloud and Microsoft Security Analytics domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

3concepts

Questions 31–35

31application · medium
A security analyst needs to create a visual dashboard that shows the geographic distribution of sign-in failures over the past 30 days. They have already ingested sign-in logs into Microsoft Sentinel. What should they use?
Select an answer first
32expert · hard
A large enterprise has Microsoft Defender for Cloud and Microsoft Sentinel deployed. The SOC wants to reduce alert fatigue by automatically closing low-confidence alerts from Defender for Cloud that are also detected by Defender for Endpoint. They want to keep high-confidence alerts for manual review. What is the most effective approach?
Select an answer first
33application · medium
A security analyst needs to search across all ingested logs in Microsoft Sentinel for a specific IP address that appeared in firewall logs, Azure AD sign-ins, and endpoint events. What should they use?
Select an answer first
34application · medium
A SOC team wants to use Microsoft Sentinel as its single platform for incident management. They currently receive alerts from Microsoft Defender for Cloud and Microsoft Defender for Endpoint. What is the most efficient way to bring these alerts into Sentinel?
Select an answer first
35application · medium
A company wants to consolidate security alerts from on-premises firewalls, AWS CloudTrail, and Microsoft 365 Defender into a single analytics platform. They also need to run custom KQL queries and set up automated response playbooks. Which solution should they choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.