A security operations center is designing a detection and response workflow using Microsoft Defender and Sentinel. They want to ensure that alerts from Defender for Cloud are enriched with threat intelligence and that response actions are automated. Select all the components they should include in their design.

Use only workbooks for response

Create automation rules that trigger playbooks

Create analytics rules that use threat intelligence tables

Disable Defender for Cloud to reduce noise

Enable the Defender for Cloud data connector in Sentinel

GIAC Certified Detection Analyst

Domain 2Objective 2

Defender and Sentinel Overview GCDA Practice Questions (Page 8)

Part of the Cloud and Microsoft Security Analytics domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 5–7 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

3concepts

Questions 36–36

36expert · hard · select all that apply
A security operations center is designing a detection and response workflow using Microsoft Defender and Sentinel. They want to ensure that alerts from Defender for Cloud are enriched with threat intelligence and that response actions are automated. Select all the components they should include in their design.
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.

Defender and Sentinel Overview GCDA Practice Questions (Page 8)

Questions 36–36

Keep studying — Cloud and Microsoft Security Analytics