Task 4.2: Implement activity and event collection in Microsoft Sentinel

• AEnable Sentinel on the DefaultWorkspace now and move it once the dedicated security resource group exists

  Incorrect

  Sentinel can't be installed on Defender for Cloud's default workspaces, and moving a Sentinel workspace later offboards it from Sentinel.

• BCreate a new Log Analytics workspace in the dedicated resource group and enable Sentinel on it

  Correct

  A dedicated workspace avoids both limits and keeps permissions in one resource group.

• CMove the DefaultWorkspace first, then enable Sentinel after the move

  Incorrect

  The default workspaces created by Defender for Cloud still can't host Sentinel.

• DEnable Sentinel on any workspace and use Azure Lighthouse to present it in the other subscription

  Incorrect

  Lighthouse delegates access; it doesn't change where the workspace lives or lift the default workspace limit.

Defender for Cloud's default workspaces aren't offered for Microsoft Sentinel, and once Sentinel is deployed on a workspace, Sentinel doesn't support moving it to another resource group or subscription: a move offboards the workspace from Sentinel immediately, and it must be re-onboarded within 90 days to keep its Sentinel data. Microsoft recommends a dedicated resource group for the Sentinel workspace so that permissions are assigned once at that level.

• AThe playbook must be moved out of rg-soar into the workspace's resource group

  Incorrect

  Playbooks can live in other resource groups once Sentinel has permissions there.

• BThe playbook must use the Microsoft Sentinel alert trigger instead of the incident trigger

  Incorrect

  Trigger type doesn't explain a greyed-out playbook.

• CThe engineer needs Microsoft Sentinel Responder on the workspace

  Incorrect

  The missing permission belongs to Sentinel itself, not the engineer's workspace role.

• DAn Owner of rg-soar grants Microsoft Sentinel permissions on it

  Correct

  Sentinel needs explicit permissions on the playbooks' resource group, and granting them requires Owner there.

Automation rules run playbooks with the Microsoft Sentinel service account, which must be granted explicit permissions on the resource group where the playbooks reside; then any automation rule can run any playbook there. Playbooks without those permissions appear unavailable, and the Manage playbook permissions link grants them, which requires Owner on the resource group.

• AA Microsoft Entra ID P1 or P2 license

  Correct

  Ingesting sign-in logs requires P1 or P2; other log types work with any license.

• BThe Global Administrator role

  Incorrect

  Security Administrator or equivalent is enough to stream the logs.

• CA Workload Identities Premium license

  Incorrect

  Sign-in log ingestion depends on the Microsoft Entra ID edition, not on a workload identity license.

• DAn Azure Monitor Agent on the domain controllers

  Incorrect

  Entra ID logs come through diagnostic settings, not an agent.

The Microsoft Entra ID connector streams logs through Entra diagnostic settings. Sign-in logs require Microsoft Entra ID P1 or P2; other log types, such as audit logs, work with any license. The user needs Security Administrator or equivalent permissions.

• AGlobal Administrator

  Incorrect

  It grants the access but is a highly privileged role.

• BCompliance Administrator in Microsoft Entra ID

  Incorrect

  It works but grants permissions for many other compliance features.

• CMembership in the Audit Reader role group in the Microsoft Purview portal

  Correct

  Searching or exporting the audit log needs the View-Only Audit Logs or Audit Logs role in the Purview portal, which its audit role groups hold.

• DThe Organization Configuration role in the Microsoft Purview portal

  Incorrect

  That role creates and modifies audit log retention policies; it isn't the role that searches the audit log.

To search or export the audit log in the Purview portal, a user needs the View-Only Audit Logs or Audit Logs role in the Purview portal; by default the Purview portal assigns these roles to the Audit Reader and Audit Manager role groups. Exchange admin center roles are still needed only to turn auditing on or off and to run the audit cmdlets. Creating audit log retention policies needs the Organization Configuration role. The Audit page in the Defender portal runs the same search; its article lists the Exchange Online role groups and the Global Administrator or Compliance Administrator role in Entra ID as the ways to get access there.

• AThe team needs Log Analytics Reader on the workspace

  Incorrect

  Resource-context RBAC grants access through the resources, not the workspace.

• BThe team can open Sentinel incidents raised from its VMs' Syslog data

  Incorrect

  Resource-context access covers log queries and workbooks, not incidents.

• CResource-context RBAC applies only to Microsoft Entra ID data

  Incorrect

  Entra ID data is non-Azure-resource data that needs extra configuration, not the only covered type.

• DThe Syslog data needs an explicitly configured resource ID to be included

  Correct

  Data that isn't from an Azure resource must be mapped to a resource ID.

• EParsers and normalization functions won't work in the team's resource-context queries

  Correct

  Functions and saved searches aren't supported in resource-centric contexts.

With resource-context RBAC, users view logs and workbooks for the resources they can access, through the resource itself or Azure Monitor, instead of getting workspace access. Data not tied to an Azure resource, such as Syslog, CEF, Microsoft Entra ID or custom collector data, needs an explicitly configured resource ID. Functions and saved searches aren't supported, so parsing and normalization aren't either.

• AYou must install an agent on each VM yourself before saving

  Incorrect

  The connector installs the agent for you.

• BThe installation script runs on them automatically

  Incorrect

  You run the script on the forwarder after the agent is installed.

• CTheir syslog daemon is replaced by the agent

  Incorrect

  The script configures the existing syslog daemon to listen and forward.

• DAzure Monitor Agent is installed on them automatically

  Correct

  The agent is installed on the VMs you select in the connector configuration.

When you configure the Syslog via AMA or CEF via AMA connector in the portal, you create the data collection rule, and Azure Monitor Agent is installed automatically on the VMs you select. You then run the installation script on the log forwarder, which configures the syslog daemon to listen for messages from other machines and opens the local ports.

• AIt records the actions inside each playbook run

  Incorrect

  Actions within playbooks are logged in the AzureDiagnostics table.

• BIngesting its health data incurs no charges

  Correct

  SentinelHealth isn't billable.

• CIt records who changed an analytics rule

  Incorrect

  Changes are recorded in the SentinelAudit table.

• DIt holds both health and audit records

  Incorrect

  Audit data goes to the separate SentinelAudit table.

Auditing and health monitoring write to two tables: SentinelHealth, which records health events such as each automation rule run and its results and isn't billable, and SentinelAudit, which records changes to rules and is billable. Actions taken inside a playbook are logged by Logic Apps in AzureDiagnostics.

• AClosing a Sentinel incident also closes the original Defender for Cloud alerts it contains

  Correct

  Status flows from Sentinel back to Defender for Cloud.

• BIt copies Sentinel analytics rules into Defender for Cloud

  Incorrect

  Sync is about alert status, not rules.

• CIt sends Defender for Cloud recommendations to Sentinel

  Incorrect

  Recommendations aren't part of alert sync.

• DIt deletes alerts in both services after 90 days

  Incorrect

  Sync doesn't delete alerts.

With alert synchronization, an alert closed in Defender for Cloud shows as closed in Microsoft Sentinel. Bi-directional sync adds the reverse: when a Sentinel incident containing the alerts is closed, the original alerts are closed in Defender for Cloud automatically. The connector is configured per subscription and is now labelled Legacy.

• AAll ingestion and automation charges for 31 days

  Incorrect

  Automation charges still apply during the trial.

• BThe first 10 GB a day for 90 days

  Incorrect

  The trial lasts 31 days.

• CThe first 10 GB a day on the Analytics logs plan for 31 days

  Correct

  Ingestion and analysis charges up to that limit are waived.

• DUnlimited Basic logs ingestion for 31 days

  Incorrect

  The trial covers Analytics logs up to 10 GB a day.

When you enable Microsoft Sentinel on a Log Analytics workspace, the first 10 GB a day ingested on the Analytics logs plan is free for 31 days, covering both Log Analytics ingestion and Sentinel analysis charges up to that limit. Charges for extra capabilities such as automation still apply.