Microsoft Sentinel SIEM and SOAR Capabilities
Which TWO of the following are features of Microsoft Sentinel? (Choose two.)
Quick Answer
The answer is Security Orchestration, Automation, and Response (SOAR). This is correct because Microsoft Sentinel is fundamentally a cloud-native Security Information and Event Management (SIEM) and SOAR solution, meaning it ingests security data from across the enterprise, applies AI to detect threats, and then automates response actions to contain incidents. On the SC-900 exam, this question tests your understanding of Sentinel’s core purpose: it is not an endpoint manager like Microsoft Intune nor an identity governance tool like Microsoft Entra ID Governance. A common trap is confusing Sentinel’s SOAR capabilities with endpoint detection, but remember that Sentinel focuses on aggregating and responding to signals from many sources, not managing individual devices. For a quick memory tip, think “Sentinel Senses and SOARs”—it senses threats across your environment and then soars into action with automated responses.
⚠ Common exam trap
Candidates often confuse Microsoft Sentinel’s SIEM+SOAR capabilities with other Microsoft security products like Defender for Endpoint (EDR) or Purview (DLP), leading them to select options that are valid security features but belong to different services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security Information and Event Management (SIEM)
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution that collects and analyzes security data from across an enterprise. It also provides Security Orchestration, Automation, and Response (SOAR) capabilities through built-in playbooks and automation rules, enabling automated incident response. These two core functions—SIEM and SOAR—are explicitly listed as features of Sentinel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Security Information and Event Management (SIEM)
Why this is correct
Correct: Core SIEM capability.
- ✗
Data loss prevention
Why it's wrong here
This is Microsoft Purview DLP.
- ✗
Endpoint detection and response
Why it's wrong here
This is Defender for Endpoint.
- ✗
Identity governance
Why it's wrong here
This is Microsoft Entra ID Governance.
- ✓
Security Orchestration, Automation, and Response (SOAR)
Why this is correct
Correct: Sentinel includes SOAR playbooks.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Event
An event is any identifiable occurrence or action in a computer system, network, or application that can be logged, monitored, or analyzed for security or operational purposes.
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are features of Microsoft Sentinel? (Choose two.)
easy- A.Identity governance and administration
- ✓ B.Security information and event management (SIEM)
- ✓ C.Security orchestration, automation, and response (SOAR)
- D.Endpoint detection and response (EDR)
- E.Data classification and labeling
Why B: Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that collects security data from across an organization, providing threat detection, investigation, and response. It also includes SOAR (Security Orchestration, Automation, and Response) capabilities through playbooks and automation rules, enabling automated incident response. These two features are core to Sentinel's functionality.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.