Sample question 1 — Manage security operations
A security operations center needs to ingest logs from many Azure and on-premises sources into a single tool, detect suspicious sign-in patterns with a scheduled query, and automatically open an incident for analysts to investigate. Which Microsoft service should the team use?
- A. Azure Log Analytics with a saved query that analysts run manually each morning.
- B. Azure Monitor with metric alerts, which notifies operators but does not create security incidents.
- C. Microsoft Sentinel with data connectors, an analytics rule, and incident creation for the detected
- D. Microsoft Defender for Cloud with only the secure score feature enabled and no alerts.
Answer: C. Option C is correct. Microsoft Sentinel ingests logs through data connectors, runs an analytics rule on a schedule to detect suspicious sign-ins, and creates an incident so analysts can investigate in one tool. Option B is incorrect because metric alerts notify operators but do not create security incidents. Option D is incorrect because secure score alone does not ingest logs or detect sign-in patterns. Option A is incorrect because a saved query that analysts run manually does not create incidents automatically.