What is the primary function of Security Orchestration, Automation, and Response (SOAR)?

To automate and orchestrate security operations tasks, such as incident response

To collect and store log data for compliance purposes

To provide a user interface for security analysts to view alerts

To encrypt sensitive data in transit across networks

How does Microsoft Sentinel provide SIEM capabilities?

By providing a virtual private network for secure remote access

By automatically patching all connected virtual machines

By collecting security data from various sources into a central workspace for analysis

By encrypting all data stored in Azure

A security operations team has a limited number of analysts. They want to ensure that every high-severity incident is acted upon within 15 minutes, but they also want to avoid overwhelming analysts with low-severity alerts. What should they configure in Microsoft Sentinel?

Hunting queries for high-severity threats

Automation rules that assign high-severity incidents to analysts and suppress low-severity alerts

Data connectors for all sources

A company currently uses separate tools for log management and alerting, but the security team wants to reduce alert fatigue by correlating events across sources. They also need to retain logs for regulatory compliance for two years. Which approach best meets both needs?

Use Microsoft Defender for Cloud for both

Use Sentinel but disable log retention

Use Microsoft Sentinel with long-term retention in Log Analytics

A security operations center wants to detect a new type of attack that has no known signature. They have historical log data in Sentinel but no custom detection rules. They need to identify the attack quickly. What should they do?

Use Microsoft Defender for Cloud's regulatory compliance reports

Use Sentinel's built-in machine learning analytics rules

Use Azure Policy to enforce security settings

Use Azure Firewall's signature-based detection

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 3Objective 3

Describe Capabilities of Microsoft Sentinel SC-900 Practice Questions (Page 8)

Part of the Describe the capabilities of Microsoft security solutions domain, which accounts for 35–40% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

35–40%of the exam

Questions 36–40

36foundation · easy
What is the primary function of Security Orchestration, Automation, and Response (SOAR)?
Select an answer first
37foundation · easy
How does Microsoft Sentinel provide SIEM capabilities?
Select an answer first
38expert · hard
A security operations team has a limited number of analysts. They want to ensure that every high-severity incident is acted upon within 15 minutes, but they also want to avoid overwhelming analysts with low-severity alerts. What should they configure in Microsoft Sentinel?
Select an answer first
39expert · hard
A company currently uses separate tools for log management and alerting, but the security team wants to reduce alert fatigue by correlating events across sources. They also need to retain logs for regulatory compliance for two years. Which approach best meets both needs?
Select an answer first
40expert · hard
A security operations center wants to detect a new type of attack that has no known signature. They have historical log data in Sentinel but no custom detection rules. They need to identify the attack quickly. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.