What is the role of playbooks in Microsoft Sentinel's SOAR capabilities?

To store security logs for long-term retention

To manage user permissions within the Sentinel workspace

To define a set of automated response actions that can be triggered by an incident

To provide a visual interface for creating custom dashboards

A security team wants to ensure that when a critical alert is generated, the incident is automatically assigned to a senior analyst and a message is posted to a Teams channel for immediate visibility. They also want to keep the ability for an analyst to manually run additional investigation steps. What should they configure in Microsoft Sentinel?

A hunting query that runs on a schedule

An automation rule that triggers a playbook to assign and notify

A data connector that ingests Teams logs

A workbook that displays the alert details

A security analyst wants to proactively search for indicators of compromise (IOCs) across all ingested logs in Sentinel. They have a list of suspicious IP addresses and want to find any matches. What should they use?

A data connector for IP intelligence

A hunting query that searches for the IP addresses

An automation rule that blocks the IPs

A workbook that displays the IPs

A company has a hybrid environment with on-premises Active Directory and Azure AD. They want to detect a potential pass-the-hash attack by correlating on-premises authentication logs with cloud sign-in logs. They also want to minimize the number of agents to deploy. What should they do?

Use Microsoft Defender for Endpoint only

Use Microsoft Sentinel with the Windows Security Events connector and Azure AD connector

A company wants to collect security logs from multiple cloud providers and on-premises systems into a single repository for analysis. They also want to use built-in queries to search for threats. What should they implement?

Azure Log Analytics workspaces only

Microsoft Sentinel with data connectors for each source

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 3Objective 3

Describe Capabilities of Microsoft Sentinel SC-900 Practice Questions (Page 7)

Part of the Describe the capabilities of Microsoft security solutions domain, which accounts for 35–40% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

35–40%of the exam

Questions 31–35

31foundation · easy
What is the role of playbooks in Microsoft Sentinel's SOAR capabilities?
Select an answer first
32application · medium
A security team wants to ensure that when a critical alert is generated, the incident is automatically assigned to a senior analyst and a message is posted to a Teams channel for immediate visibility. They also want to keep the ability for an analyst to manually run additional investigation steps. What should they configure in Microsoft Sentinel?
Select an answer first
33expert · hard
A security analyst wants to proactively search for indicators of compromise (IOCs) across all ingested logs in Sentinel. They have a list of suspicious IP addresses and want to find any matches. What should they use?
Select an answer first
34expert · hard
A company has a hybrid environment with on-premises Active Directory and Azure AD. They want to detect a potential pass-the-hash attack by correlating on-premises authentication logs with cloud sign-in logs. They also want to minimize the number of agents to deploy. What should they do?
Select an answer first
35application · medium
A company wants to collect security logs from multiple cloud providers and on-premises systems into a single repository for analysis. They also want to use built-in queries to search for threats. What should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.