SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Data connectors

  Why this is correct

  Microsoft Sentinel's primary function as a Security Information and Event Management (SIEM) solution relies on ingesting security data from diverse sources. Data connectors are the specific mechanisms that facilitate this ingestion, establishing a secure link between various data sources (like Azure Activity Logs, Microsoft 365 Defender, firewalls, or custom applications) and the Log Analytics workspace underpinning Sentinel. They normalize and stream logs, making them available for analysis, threat detection, and investigation within the platform. For sources without direct API integration, generic connectors like Syslog or Common Event Format (CEF) are utilized to centralize data.

• ✗

  Playbooks

  Why it's wrong here

  Microsoft Sentinel playbooks, built on Azure Logic Apps, are designed for Security Orchestration, Automation, and Response (SOAR). They automate incident response tasks, such as enriching alerts with external threat intelligence, blocking malicious IPs, or creating tickets in ITSM systems, typically triggered by analytics rules or manual intervention. While crucial for efficient security operations, playbooks operate on *existing* alerts and incidents within Sentinel and do not perform the initial collection or ingestion of raw security logs from various sources.

  When this WOULD be correct

  A security team needs to automate incident response actions, such as blocking an IP address on a firewall, when a specific alert is triggered in Microsoft Sentinel. Playbooks would be the correct answer.

• ✗

  Workbooks

  Why it's wrong here

  Microsoft Sentinel workbooks offer flexible and interactive dashboards for visualizing and monitoring security data. They allow security analysts to create custom reports, track key performance indicators (KPIs), and gain insights into security posture by querying and presenting data from the underlying Log Analytics workspace. While invaluable for data exploration and reporting, workbooks are purely a presentation layer; they consume and display data that has *already been ingested* and processed by Sentinel, rather than performing any data collection themselves.

  When this WOULD be correct

  A security team needs to create a custom dashboard to monitor trends in firewall log data that has already been ingested into Microsoft Sentinel. They should use Workbooks to build interactive visualizations and reports.

• ✗

  Analytics rules

  Why it's wrong here

  Analytics rules in Microsoft Sentinel are fundamental for proactive threat detection, leveraging Kusto Query Language (KQL) to define patterns or anomalies within ingested log data. These rules continuously scan the collected logs, generating security alerts and incidents when predefined conditions are met, such as multiple failed login attempts or suspicious process executions. However, their role is solely to analyze and identify threats from data *already present* in the Log Analytics workspace, not to facilitate the initial collection or centralization of that data.

  When this WOULD be correct

  A security team has already ingested firewall logs into Microsoft Sentinel and wants to create automated alerts for suspicious traffic patterns. In that scenario, analytics rules would be the correct choice to define detection logic and trigger incidents.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question