Microsoft Azure Fundamentals (AZ-900)Describe Azure management and governanceHard
A global company needs to monitor its Azure environment for security threats, collect security logs from various sources (e.g., Azure Activity Logs, Azure AD, firewalls), and use security orchestration, automation, and response (SOAR) capabilities to automatically handle incidents. Which Azure service provides these comprehensive SIEM and SOAR capabilities?
- AMicrosoft Sentinel
- BAzure Security Center
- CAzure Monitor
- DAzure Log Analytics
Show answer & explanationAnswer & explanation
Correct answer: A. Microsoft Sentinel
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It provides capabilities for security analytics, threat intelligence, and automated response across an enterprise's digital estate, including Azure resources.
Why the other options are wrong
- B. Azure Security Center (now Microsoft Defender for Cloud) provides security posture management and threat protection for Azure resources, but Microsoft Sentinel offers more comprehensive SIEM/SOAR functionality for an entire enterprise.
- C. Azure Monitor is a foundational monitoring service, collecting metrics and logs, but does not include SIEM/SOAR capabilities.
- D. Azure Log Analytics is a component of Azure Monitor for collecting and querying logs, but it is not a SIEM/SOAR solution itself.
Microsoft Sentinel (SIEM/SOAR)
A cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution that provides intelligent security analytics and threat intelligence across an enterprise.
- Cloud-native SIEM and SOAR.
- Collects security data from many sources.
- Detects, investigates, and responds to threats.
- Uses AI and machine learning for threat detection.
Memory trick: Sentinel acts as your 24/7 security guard, collecting, analyzing, and reacting.