Module assessment

1.

As the lead admin, it's important to convince your team to start using Microsoft Sentinel. You’ve put together a presentation. What are the four security operation areas of Microsoft Sentinel?

Collect, Detect, Investigate, and Redirect.

Collect, Detect, Investigate, and Respond.

Collect, Detect, Investigate, and Repair.

2.

A security analyst suspects that a threat actor is active in the environment but no alert has been triggered yet. Which Microsoft Sentinel capability lets the analyst proactively search for suspicious activity before an alert fires?

Threat hunting.

Automation rules.

Playbooks.

3.

A security analyst is tasked with investigating a specific incident using Microsoft Sentinel. They want to obtain a summary of the incident, related alerts, reputation scores, users, and devices. What functionality should they use?

Microsoft Sentinel KQL (Preview) plugin

Microsoft Sentinel incident investigation promptbook

Jupyter notebooks

4.

A security operations team is struggling with alert fatigue—analysts are overwhelmed by the volume of alerts and missing genuine threats. Which capability in a modern SIEM/SOAR solution most directly addresses this problem?

Generating more alerts from more data sources to improve coverage.

Using AI and machine learning to group related alerts into incidents, assign severity scores, and reduce false positives.

Disabling alerts from lower-priority data sources to reduce volume.

5.

What best describes Microsoft Security Copilot?

A cloud-native SIEM/SOAR platform that collects and analyzes security data to detect and respond to threats.

A generative AI-powered security solution that helps defenders investigate threats, summarize incidents, and build KQL queries through natural language.

A data connector that links Microsoft Sentinel to non-Microsoft security tools and automates playbook execution.

Check your knowledge

Feedback