What is the primary purpose of a Security Information and Event Management (SIEM) system?

To encrypt data at rest and in transit to protect confidentiality

To automatically remediate security incidents without human intervention

To collect and analyze security data from multiple sources for threat detection and investigation

To enforce access control policies across an organization's network

A security team wants to reduce the time between alert detection and response by automatically blocking malicious IP addresses and notifying the incident response team. What capability of Microsoft Sentinel should they use?

SIEM capabilities with data connectors

SOAR capabilities with playbooks

A company has a hybrid environment with on-premises servers and Azure workloads. They want to use Microsoft Sentinel to monitor both, but they have limited network bandwidth to the cloud. What should they consider?

Use only cloud workloads in Sentinel

Use a VPN to connect on-premises to Azure

Use Azure Arc to connect on-premises servers and send logs to Sentinel

Which scenario best illustrates the use of SOAR capabilities?

A network administrator manually configures firewall rules to block an IP address

A security team uses a playbook that automatically disables a compromised user account and opens a ticket

An organization stores all security logs in a central database for future analysis

An analyst manually reviews a list of firewall logs to identify a pattern of failed login attempts

A security team wants to automatically create a support ticket and assign it to the appropriate analyst whenever a high-severity incident is detected. What should they configure in Microsoft Sentinel?

Automation rules that trigger a playbook

A workbook to display incidents

A data connector for the ticketing system

A hunting query to find incidents

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 3Objective 3

Describe Capabilities of Microsoft Sentinel SC-900 Practice Questions (Page 9)

Part of the Describe the capabilities of Microsoft security solutions domain, which accounts for 35–40% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

35–40%of the exam

Questions 41–45

41foundation · easy
What is the primary purpose of a Security Information and Event Management (SIEM) system?
Select an answer first
42application · medium
A security team wants to reduce the time between alert detection and response by automatically blocking malicious IP addresses and notifying the incident response team. What capability of Microsoft Sentinel should they use?
Select an answer first
43expert · hard
A company has a hybrid environment with on-premises servers and Azure workloads. They want to use Microsoft Sentinel to monitor both, but they have limited network bandwidth to the cloud. What should they consider?
Select an answer first
44foundation · easy
Which scenario best illustrates the use of SOAR capabilities?
Select an answer first
45application · medium
A security team wants to automatically create a support ticket and assign it to the appropriate analyst whenever a high-severity incident is detected. What should they configure in Microsoft Sentinel?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.