Task 3.3: Describe capabilities of Microsoft Sentinel

• AMicrosoft Defender for Cloud with its AWS connector

  Incorrect

  The AWS connector lets Defender for Cloud assess and protect AWS resources, but Defender for Cloud isn't a SIEM that ingests firewall logs and correlates them in analytics rules.

• BMore Defender XDR workloads, such as Defender for Identity

  Incorrect

  Defender XDR products correlate signals from Microsoft's own suite; they don't ingest CloudTrail events or third-party firewall logs.

• CMicrosoft Sentinel, in the same Defender portal

  Correct

  Sentinel collects data from Microsoft, non-Microsoft and custom sources through more than 350 connectors, and it works in the Defender portal beside Defender XDR.

• DMicrosoft Purview Audit (Premium)

  Incorrect

  Audit records user and admin activities in Microsoft 365 services; it doesn't collect firewall or AWS logs.

Defender XDR correlates signals across its own products for endpoints, identities, email and apps. Microsoft Sentinel adds the SIEM: more than 350 connectors bring in data from Microsoft services, non-Microsoft platforms such as AWS and custom sources such as an on-premises firewall, analytics rules correlate it, and the data stays available for proactive hunting. In the Microsoft Defender portal, Sentinel and Defender XDR work as one platform.

• AAn automation rule

  Incorrect

  Automation rules manage incidents that already exist, for example by assigning them or triggering a playbook; they don't query the collected data.

• BA workbook

  Incorrect

  Workbooks visualize and monitor data in charts and dashboards; they don't raise alerts.

• CA hunting query

  Incorrect

  Analysts run hunting queries proactively when they choose; a hunting query doesn't run every hour by itself.

• DAn analytics rule

  Correct

  Analytics rules query the collected data on a regular basis and generate alerts when they find suspicious activity.

Microsoft Sentinel detects threats with analytics rules, which run regularly against the collected data and generate alerts when suspicious activity is found. Automation rules then manage how the resulting incidents are handled, workbooks visualize the data, and hunting queries support the searches analysts start themselves.

• AMicrosoft Purview data loss prevention policies

  Incorrect

  DLP policies are created in Microsoft Purview; they aren't Sentinel content.

• BData connectors

  Correct

  Solutions bundle data connectors with other content types for an end-to-end scenario.

• CMicrosoft Entra Conditional Access policies

  Incorrect

  Conditional Access policies are configured in Microsoft Entra ID, not deployed from Sentinel's Content hub.

• DAnalytics rules

  Correct

  Analytics rules, with workbooks, hunting queries and playbooks, are among the content types a solution bundles.

• EDefender for Endpoint onboarding packages

  Incorrect

  Device onboarding belongs to Defender for Endpoint, not to Sentinel solutions.

The Content hub is the central place to discover and deploy packaged solutions in Microsoft Sentinel. Each solution bundles several content types, such as data connectors, workbooks, analytics rules, hunting queries and playbooks, into a single deployment for a complete end-to-end scenario. Prebuilt rule templates also come from the Content hub.

• AWait for the Content hub to publish a rule template for the technique

  Incorrect

  Templates help with known patterns, but she wants to search now rather than wait.

• BBuild a playbook that runs when an incident about the technique is created

  Incorrect

  A playbook runs remediation actions from an automation rule or on demand; it doesn't search the data, and no incident exists for undetected activity.

• CCreate an automation rule that raises the severity of related incidents

  Incorrect

  Automation rules manage how incidents are handled; they don't search data for undetected activity.

• DRun a hunting query across the data, then promote it to a custom analytics rule

  Correct

  Hunting searches data proactively for activity that hasn't triggered a rule, and a significant query can become an analytics rule that alerts automatically.

For proactive detection, Microsoft Sentinel supports threat hunting: instead of waiting for an alert, the team runs hunting queries across its data for suspicious activity that hasn't triggered a rule. When a hunting query surfaces a significant finding, it can be promoted into a custom analytics rule so that it generates alerts automatically in the future.

• AA SIEM protects endpoints, while a SOAR protects email

  Incorrect

  Both work across many sources; neither is tied to one kind of asset.

• BA SIEM runs only in the cloud, while a SOAR runs only in on-premises datacenters

  Incorrect

  Deployment location doesn't define them.

• CA SIEM automates responses, while a SOAR collects logs

  Incorrect

  That's the reverse of their roles.

• DA SIEM surfaces threats from collected data; a SOAR automates the response

  Correct

  A SIEM gives visibility into threats in the data it collects; a SOAR responds to them with automated workflows.

A security information and event management (SIEM) system collects data from across the environment, analyzes it to surface potential threats and raises alerts. Security orchestration, automation and response (SOAR) takes alerts from a SIEM and other tools and triggers action-driven automated workflows. Together they form the foundation of a modern SOC.

• ALog aggregation

  Incorrect

  Aggregation gathers logs into one platform; it doesn't relate events to each other.

• BEncryption

  Incorrect

  Encryption protects data; it isn't a SIEM analysis function.

• CCorrelation

  Correct

  Correlation looks for patterns, relationships and anomalies across collected data, so related events become significant.

• DProvisioning

  Incorrect

  Provisioning creates identities; it isn't a SIEM function.

A SIEM aggregates logs from many sources, then correlates them, looking for patterns, relationships and anomalies that might indicate a threat. An event that seems harmless in isolation, such as an unusual sign-in time, becomes significant when correlated with others, such as a large download of sensitive files.

• ATurning off the alerts that come from the noisiest data sources entirely

  Incorrect

  Turning off sources can hide real threats; modern platforms consolidate rather than silence.

• BStoring alerts for longer

  Incorrect

  Longer retention doesn't reduce the number of items analysts handle.

• CGrouping related alerts from different sources into a single incident

  Correct

  Incident grouping lets an analyst review one incident with its context instead of dozens of alerts about the same attack.

• DSending every alert to every analyst

  Incorrect

  Broadcasting alerts adds to the overload.

Alert fatigue sets in when analysts are overwhelmed by alert volume and begin dismissing alerts. Modern SIEM and SOAR platforms address it with incident grouping, which consolidates related alerts from different sources into one incident, plus severity scoring and automatic enrichment with context such as threat intelligence and user history.

• ACorrelation

  Incorrect

  Correlation isn't about making tools work together.

• BLog aggregation

  Incorrect

  Aggregation gathers data into one place; it doesn't coordinate tools.

• CHashing

  Incorrect

  Hashing creates fixed-length fingerprints of data; it isn't a SOAR concept.

• DOrchestration

  Correct

  Orchestration connects different security tools and systems so that they work together.

SOAR introduces two concepts into security operations. Orchestration connects different security tools and systems so that they work together, such as querying an identity system, checking threat intelligence and notifying the team at once. Automation handles repetitive tasks without manual effort.