SC-100 Certification Practice Question #158

Question

A customer has a Microsoft 365 E5 subscription and an Azure subscription.
The customer wants to centrally manage security incidents, analyze logs, audit activities, and search for potential threats across all deployed services
You need to recommend a solution for the customer.
What should you include in the recommendation?

Accepted Answer

The requirement is to centrally manage security incidents, analyze logs, audit activities, and hunt/search for threats across all deployed services — the textbook definition of a SIEM/SOAR. Microsoft Sentinel is Microsoft's cloud-native SIEM/SOAR built on a Log Analytics workspace; it ingests signals from Microsoft 365, Defender, Azure, and 350+ connectors, and provides incident management, log analytics (KQL), auditing, and proactive hunting. MS Learn's MCSB control LT-5 names Sentinel as the platform to "centralize security log management and analysis." Suggested Answer, Most Voted (unanimous, 20 votes), two Highly-Voted comments, and MS Learn all agree with no dissent, so confidence is high. The Defender products handle posture/workload, app, or M365-scoped XDR but are not the cross-service SIEM/hunting solution.

More SC-100 practice questions