Knowledge check

Completed

Choose the best response for each of the questions below.

Check your knowledge

1.

As the lead admin, it's important to convince your team to start using Microsoft Sentinel. You’ve put together a presentation. What are the four security operation areas of Microsoft Sentinel?

Collect, Detect, Investigate, and Redirect.

Collect, Detect, Investigate, and Respond.

Collect, Detect, Investigate, and Repair.

2.

Your estate has many different data sources where data is stored. Which tool should be used with Microsoft Sentinel to quickly gain insights across your data as soon as a data source is connected?

Azure Monitor Workbooks.

Playbooks.

Microsoft Defender XDR.

3.

A security analyst is tasked with investigating a specific incident using Microsoft Sentinel. They want to obtain a summary of the incident, related alerts, reputation scores, users, and devices. What functionality should they use?

Microsoft Sentinel KQL (Preview) plugin

Microsoft Sentinel incident investigation promptbook

Jupyter notebooks

You must answer all questions before checking your work.