Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Microsoft Sentinel Cloud-Native SIEM and Automation
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise wants to centralize threat intelligence and security event analysis across its multi-cloud and on-premises environments. The organization needs a cloud-native Security Information and Event Management (SIEM) solution that can collect data from multiple sources, detect sophisticated threats using analytics, and automate incident response.
Which Azure service should the enterprise implement?
Explanations
Azure Policy
Azure Policy
What Azure Policy Is
Azure Policy is a governance service that allows organizations to enforce resource standards and assess configuration compliance across their Azure environment.
Why It Doesn't Meet the Requirement
Azure Policy focuses on governance and configuration baseline auditing (such as checking whether disk encryption is enabled or restricting subnet deployments). It does not analyze real-time operational log streams, aggregate external threat intelligence, or provide automated incident management for active security breaches.
Key Characteristics and Limitations
- Governance Enforcement: Prevents the creation of non-compliant resources or audits existing resources against baseline rules.
- Control-Plane Focus: Evaluates resource metadata and configurations at deployment time or during periodic compliance evaluations.
- Lack of SIEM Functionality: Does not provide log event correlation, behavioral analytics, or active cyber threat detection.
This Answer Would Be Correct If
The organization wanted to enforce mandatory resource compliance baselines, audit configuration drift across subscriptions, or mandate security settings like requiring specific network controls.
Azure Monitor Logs
Azure Monitor Logs
What Azure Monitor Logs Is
Azure Monitor Logs is a managed observability and log ingestion platform designed to collect, index, and analyze operational telemetry from cloud and hybrid resources.
Why It Doesn't Meet the Requirement
While Azure Monitor Logs provides the underlying data storage and indexing layer via Log Analytics workspaces, it is fundamentally a general-purpose operational monitoring tool rather than a specialized SIEM solution. It does not provide built-in threat intelligence feeds, specialized cyber-attack correlation rules, or native security incident orchestration out of the box.
Key Characteristics and Limitations
- Operational Focus: Concentrates on system health, performance metrics, and infrastructure diagnostics rather than cyber threat detection.
- Data Foundation: Acts as the data platform upon which dedicated security services, like Microsoft Sentinel, are layered.
- Query Capabilities: Enables complex data retrieval using KQL, but requires manual configuration to identify security anomalies.
This Answer Would Be Correct If
The organization needed a central repository to collect diagnostic logs, monitor application throughput, and analyze operational health across diverse workloads without requiring specialized SIEM analytics.
Microsoft Sentinel
Microsoft Sentinel
What Microsoft Sentinel Is
Microsoft Sentinel is a scalable, cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. Built on top of the Azure Monitor log platform, it provides intelligent security analytics and enterprise-wide threat intelligence to defend against modern cyber threats.
How It Meets Enterprise Requirements
- Unified Data Collection: Ingests security event logs and telemetry at cloud scale across users, devices, applications, and infrastructure, whether hosted in Azure, other clouds, or on-premises.
- Threat Detection and Analytics: Utilizes advanced artificial intelligence and machine learning models to identify real threats and minimize alert fatigue.
- Automated Incident Response: Enables security operations teams to orchestrate responses and automatically mitigate risks using playbooks powered by Azure Logic Apps.
Key Advantages and Capabilities
- Cloud-Native Architecture: Eliminates the maintenance overhead of managing servers, storage, and software updates required by traditional on-premises SIEM deployments.
- Seamless Integration: Natively integrates with Microsoft security solutions, such as Microsoft Defender for Cloud, as well as numerous third-party tools and data formats via built-in connectors.
- Proactive Threat Hunting: Offers built-in queries and threat-hunting tools to detect anomalous behaviors before vulnerabilities can be actively exploited.
- Flexible Log Analytics: Leverages the power of Log Analytics workspaces and Kusto Query Language (KQL) for rapid data analysis across vast volumes of operational and security records.
Why This Is Optimal
Microsoft Sentinel is the optimal choice because it is purpose-built for comprehensive enterprise threat management, correlation, and response. While operational monitoring tools collect raw telemetry, Sentinel transforms that data into actionable security insights and coordinates end-to-end incident management.
Azure Update Manager
Azure Update Manager
What Azure Update Manager Is
Azure Update Manager is an integrated management service that automates operating system patching and update compliance tracking across virtual machines in Azure and hybrid environments.
Why It Doesn't Meet the Requirement
Azure Update Manager is designed specifically for software update deployment and patch lifecycle management. It cannot ingest external security logs, perform enterprise-wide threat analytics, or act as a SIEM solution to respond to active cyber attacks.
Key Characteristics and Limitations
- Patch Orchestration: Automates scheduling and installation of critical OS updates to remediate known vulnerabilities.
- Compliance Reporting: Delivers detailed summaries showing which machines meet organizational patching standards.
- Scope Limitation: Operates strictly within the domain of operating system maintenance, lacking network and identity threat detection tools.
This Answer Would Be Correct If
The organization required an automated tool to streamline routine software updates, minimize risks from unpatched operating systems, and generate patch compliance reports without managing additional patching infrastructure.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC
Describe the benefits of security and governance in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy
Describe the benefits of security and governance in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Key Vault
Describe the benefits of security and governance in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Regulatory Compliance
Describe the benefits of security and governance in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Availability Zones Fault Isolation
Describe availability zones
ExpertAZ-500 Microsoft Azure Security Technologies Exam
Application Permissions vs Delegated Permissions
Configure app registration permission scopes
Last updated Validated