Microsoft · SC-900
Microsoft Sentinel
SC-900 · Lesson 9 of 15 · 1:04:32
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-900 exam (Microsoft Security, Compliance, and Identity Fundamentals). In this lesson: SIEM and SOAR, Microsoft Sentinel as a cloud-native SIEM and SOAR, data connectors, the analytics and data lake tiers, analytics rules, the Content hub, machine learning and Fusion, threat intelligence and MITRE ATT&CK, incidents and KQL threat hunting, automation rules and Logic Apps playbooks, Security Copilot, and the Microsoft Defender portal, its only home after the Azure portal experience retires on March 31, 2027. Includes three original practice questions.
Preview the topics
- When an incident shows a compromised account, a company wants the account disabled, the security team notified, and a ticket opened, automatically. Which capability does that?
- A risky sign-in, an unusual download, and a malware alert come from different products, and no single rule would catch them. Which Sentinel capability links them into one high-confidence incident?
- Every new high-severity incident from the finance subscription must go straight to a senior analyst, with its status set to active. What should the team create?