Question bank
Microsoft Certified: Security Operations Analyst Associate
41 Microsoft Certified: Security Operations Analyst Associate questions with the correct answer and a written explanation, organised across 3 exam domains.
- 41 questions
- 3 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Manage a security operations environment
16 questions in this domain
- Question 1Single Choice
What does Microsoft Sentinel use as its workspace when you enable it?
- AA dedicated Sentinel-created workspace
- BAn existing Log Analytics workspaceCorrect answer
- CA separate Azure Monitor workspace
- DA new resource group workspace
Why this is the answer
Sentinel is enabled on an existing Log Analytics workspace; it does not create a separate workspace during enablement.
- Question 2Multiple Select
Which statements accurately compare the Log Analytics Reader and Microsoft Sentinel Reader roles?
- ALog Analytics Reader can view data but cannot manage Sentinel resources.Correct answer
- BMicrosoft Sentinel Reader grants read access to Sentinel data and resources.Correct answer
- CThe two roles have exactly the same permissions.
- DLog Analytics Reader is sufficient to create analytics rules.
Why this is the answer
Log Analytics Reader is data-focused, while Sentinel Reader adds read access to Sentinel-specific resources. They are not equivalent.
- Question 3Interactive
Examine the code block. What does the first identifier represent in the query?
- ALog Analytics tableCorrect answer
- BPlaybook
- CData Collection Rule
- DCustom connector
Why this is the answer
SecurityEvent is a built-in Log Analytics table commonly used in Microsoft Sentinel. The query reads events from that table.
- Question 4Single Choice
When selecting a Log Analytics workspace region for Microsoft Sentinel, what must be considered first?
- ACost and availability only
- BOrganizational compliance requirementsCorrect answer
- CThe region of the nearest branch office
- DThe number of existing connectors
Why this is the answer
Regions must satisfy compliance requirements before cost or availability are considered. Choosing the wrong region can violate data residency policies.
- Question 5Multiple Select
Which statements about enabling data connectors in Microsoft Sentinel are true?
- ASome connectors require permissions beyond Microsoft Sentinel Contributor.Correct answer
- BMicrosoft Sentinel Contributor alone is enough for every connector.
- CConnector-specific prerequisites may include extra roles or licenses.Correct answer
- DNo connector requires additional Azure role assignments.
Why this is the answer
Connectors often have prerequisites; the Contributor role is not universally sufficient. Always review connector documentation.
- Question 6Interactive
Examine the code block. What is the typical scope of the resource type shown?
- AVirtual machine or resourceCorrect answer
- BLog Analytics workspace
- CMicrosoft Sentinel instance
- DAzure subscription
Why this is the answer
Data Collection Rules are scoped to resources such as virtual machines, not to a workspace or Sentinel instance.
- Question 7Single Choice
Which agent should be used to collect custom logs in a modern Microsoft Sentinel implementation?
- AAzure Log Analytics agent
- BAzure Monitor AgentCorrect answer
- CMicrosoft Monitoring Agent
- DOperations Manager agent
Why this is the answer
The Azure Monitor Agent is the modern option for custom log ingestion, replacing the legacy Log Analytics agent.
- Question 8Multiple Select
Which statements about Azure Monitor Agent and custom logs are correct?
- AAzure Monitor Agent is the modern solution.Correct answer
- BThe Azure Log Analytics agent is still the default for new deployments.
- CCustom logs can be collected through AMA using data collection rules.Correct answer
- DAll custom log ingestion requires the legacy Log Analytics agent.
Why this is the answer
Azure Monitor Agent is current; data collection rules define custom log ingestion. Legacy agents are not the modern default.
- Question 9Interactive
Examine the code block. Which consideration is supported by this setting for custom log ingestion?
- ANetwork isolationCorrect answer
- BTable schema verification
- CSentinel role assignment
- DData archiving
Why this is the answer
Data Collection Endpoints support privacy and network isolation by allowing public network access to be disabled.
- Question 10Single Choice
What should you do when your data source is not listed in the Microsoft Sentinel connector catalog?
- AUse a built-in connector for a similar source
- BCreate a custom connectorCorrect answer
- CEnable the source with Sentinel Contributor only
- DIgnore the source because it cannot be ingested
Why this is the answer
If no built-in connector exists, a custom connector is required to ingest the source into Sentinel.
- Question 11Multiple Select
Why is verifying the table schema important for custom logs in Microsoft Sentinel?
- AThe table must exist before ingestion.Correct answer
- BA mismatch can cause ingestion or query failures.Correct answer
- CSchema is automatically corrected by Sentinel.
- DTable schema only matters for playbooks.
Why this is the answer
Before sending custom logs, the target Log Analytics table must exist and have a matching schema to avoid failed ingestion or queries.
- Question 12Interactive
Examine the code block. Why is it not possible to add a custom column to this table?
- AIt is a built-in table with a fixed schema.Correct answer
- BIt is a custom log table managed by DCR.
- CThe table is in Basic Logs.
- DThe table is not in a Log Analytics workspace.
Why this is the answer
SecurityEvent is a built-in table. DCR transformations cannot change the schema of built-in tables like SecurityEvent.
- Question 13Single Choice
How should you apply long-term retention when only one table must be kept for compliance?
- ASet retention on the entire workspace
- BUse table-level retentionCorrect answer
- CDisable analytics on all other tables
- DExport the table to a storage account
Why this is the answer
For a compliance-controlled table, use table-level retention so long-term storage applies only to that table, not the whole workspace.
- Question 14Multiple Select
Which statements about table-level retention are accurate?
- AIt allows long-term retention for specific tables.Correct answer
- BIt avoids applying long retention to all workspace data.Correct answer
- CIt is only available for Basic Logs tables.
- DIt prevents all queries on the table.
Why this is the answer
Table-level retention targets specific tables for longer retention while not forcing the entire workspace to keep data longer.
- Question 15Interactive
Examine the code block. What is true about the table plan displayed?
- AIt reduces query capabilities.Correct answer
- BIt supports all KQL operators.
- CIt is required for all analytics tables.
- DIt preserves full query features.
Why this is the answer
Changing a table to Basic Logs reduces query capabilities compared with the Analytics plan while lowering cost.
- Question 16Single Choice
What is true about archived data in a Log Analytics workspace?
- AIt can be queried directly with regular KQL.
- BIt cannot be queried with a regular KQL query.Correct answer
- CIt automatically performs like analytic data.
- DIt is deleted after 30 days.
Why this is the answer
Archived data is not directly queryable with normal KQL; it requires a search job or restore before querying.
Perform threat hunting
10 questions in this domain
- Question 17Single Choice
When Microsoft Sentinel is enabled, what is true about the workspace?
- AIt uses an existing Log Analytics workspaceCorrect answer
- BIt creates a separate Sentinel workspace
- CIt creates a workspace only if none exists
- DIt requires a dedicated new resource group
Why this is the answer
Microsoft Sentinel is enabled on an existing Log Analytics workspace; it does not create a separate workspace automatically.
- Question 18Multiple Select
Which statements about Microsoft Sentinel and Log Analytics reader roles are correct?
- AThey grant identical permissions
- BCan read data but not Sentinel resourcesCorrect answer
- CViews Sentinel resources specificallyCorrect answer
- DContributor is required to view Sentinel data
Why this is the answer
Log Analytics Reader covers Log Analytics data, while Microsoft Sentinel Reader grants Sentinel-specific viewing permissions. They are not interchangeable.
- Question 19Interactive
A team selects the region shown in the code block for a new Sentinel workspace. What risk should be considered?
- AData residency and compliance requirementsCorrect answer
- BThe pricing tier of Microsoft Sentinel
- CThe number of existing workspaces
- DThe Log Analytics agent version
Why this is the answer
Choosing a region based only on cost or availability can violate data residency and compliance requirements; the region must satisfy organizational policies.
- Question 20Single Choice
Why might Microsoft Sentinel Contributor be insufficient to enable a data connector?
- ASome connectors need extra source permissionsCorrect answer
- BContributor cannot access Sentinel at all
- CAll connectors require Global Administrator
- DConnectors never need more than Contributor
Why this is the answer
Several connectors need additional permissions on their source systems; the Contributor role alone is not enough for every connector.
- Question 21Multiple Select
Which of the following are common connector mistakes in Microsoft Sentinel?
- AAssuming Contributor alone can enable every connectorCorrect answer
- BUsing built-in connector for uncataloged sourceCorrect answer
- CEnabling only one connector for all data
- DAssigning Log Analytics Reader role to connectors
Why this is the answer
Common connector traps include expecting Contributor alone to enable any connector and using a built-in connector for a source not in the catalog.
- Question 22Interactive
The code block shows an agent selected for custom log collection. Which modern agent should be used instead?
- AAzure Monitor AgentCorrect answer
- BMicrosoft Sentinel Agent
- CMicrosoft Defender XDR connector
- DMicrosoft Monitoring Agent
Why this is the answer
Azure Monitor Agent is the modern agent for custom logs, replacing the legacy Log Analytics agent.
- Question 23Single Choice
What should you do when a data source is not listed in the Microsoft Sentinel connector catalog?
- AUse custom connector or custom ingestionCorrect answer
- BPick any built-in connector with similar name
- CEnable Sentinel without a workspace
- DUse Log Analytics Reader role for connection
Why this is the answer
If a source is not in the connector catalog, you should use a custom connector or custom ingestion method rather than forcing a built-in connector.
- Question 24Multiple Select
Which statements about a Data Collection Endpoint in custom ingestion are true?
- AProvides an endpoint for custom dataCorrect answer
- BSupports privacy and network isolationCorrect answer
- CReplaces the Log Analytics workspace
- DUsed only with built-in connectors
Why this is the answer
A Data Collection Endpoint provides a collection endpoint and supports privacy or network isolation; it does not replace the workspace and is not limited to built-in connectors.
- Question 25Interactive
The code block shows a custom log table configuration before ingestion. What important validation is missing?
- ATable schema matches the incoming dataCorrect answer
- BTable has Microsoft Sentinel Reader role
- CTable is already in archive tier
- DTable has a built-in connector
Why this is the answer
Before custom log ingestion, verify the Log Analytics table schema matches the incoming data; otherwise ingestion can fail or data can be dropped.
- Question 26Single Choice
When is it appropriate to apply long-term retention to a specific table instead of the whole workspace?
- AWhen only certain data needs long retentionCorrect answer
- BWhen all data must be retained indefinitely
- CWhen Log Analytics Reader role is used
- DWhen creating a new Data Collection Endpoint
Why this is the answer
If only certain tables must be kept long term for compliance, apply retention to those tables instead of the whole workspace.
Respond to security incidents
15 questions in this domain
- Question 27Single Choice
What happens when Microsoft Sentinel is enabled?
- AIt creates a new, dedicated Log Analytics workspace.
- BIt uses an existing Log Analytics workspace that you select.Correct answer
- CIt requires a separate workspace for each region.
- DIt creates a workspace automatically in the same resource group.
Why this is the answer
Microsoft Sentinel is enabled on an existing Log Analytics workspace; it does not create its own separate workspace automatically.
- Question 28Multiple Select
Which statements about the Log Analytics Reader and Microsoft Sentinel Reader roles are correct? Select all that apply.
- ALog Analytics Reader can read log data but cannot read Sentinel-specific resources.Correct answer
- BMicrosoft Sentinel Reader and Log Analytics Reader provide identical permissions.
- CMicrosoft Sentinel Reader provides read-only access to Sentinel resources.Correct answer
- DLog Analytics Reader can manage Microsoft Sentinel playbooks.
Why this is the answer
Log Analytics Reader is limited to workspace data, while Microsoft Sentinel Reader adds read access to Sentinel-specific resources.
- Question 29Interactive
Review the deployment template excerpt. What does the association demonstrate about data collection rules?
- ADCRs are scoped to a Log Analytics workspace.
- BDCRs are scoped to resources such as virtual machines.Correct answer
- CDCRs are automatically applied to all resources in a subscription.
- DDCRs can change the schema of a built-in table.
Why this is the answer
A data collection rule association links a DCR to a specific resource, such as a VM, not to a workspace.
- Question 30Single Choice
Why is the region an important consideration when selecting a Microsoft Sentinel workspace?
- AThe region should meet data residency and compliance requirements.Correct answer
- BThe region can always be changed without any impact.
- CThe region has no effect on data storage or compliance.
- DThe region should be selected for the lowest possible availability.
Why this is the answer
Workspace region selection should consider compliance and data residency, not only cost or availability.
- Question 31Multiple Select
Which statements about enabling Microsoft Sentinel data connectors are correct? Select all that apply.
- AMicrosoft Sentinel Contributor role can enable every data connector without other requirements.
- BSome data connectors require additional permissions or licenses beyond Microsoft Sentinel Contributor.Correct answer
- CThe Microsoft Defender XDR connector is identical to every individual solution-based connector.
- DYou should verify that a connector appears in the connector catalog before enabling it.Correct answer
Why this is the answer
Not all connectors work with Contributor alone; some require additional permissions, and connectors should be verified in the catalog.
- Question 32Interactive
Review the data collection rule definition. Which agent is configured for custom log collection?
- AAzure Log Analytics agent
- BAzure Monitor AgentCorrect answer
- CMicrosoft Monitoring Agent
- DAzure Diagnostics Agent
Why this is the answer
The extension name AzureMonitorAgent indicates that the Azure Monitor Agent, not the legacy Log Analytics agent, is used for custom logs.
- Question 33Single Choice
What should an analyst do if a source does not have a built-in connector in Microsoft Sentinel?
- AUse a built-in connector that appears similar, even if it does not match.
- BBuild a custom connector or use another ingestion method.Correct answer
- CEnable the source with the Microsoft Sentinel Contributor role only.
- DUse the Microsoft Defender XDR connector for every unsupported source.
Why this is the answer
If a source is not in the connector catalog, you should not force a mismatched built-in connector; use a custom connector or alternate ingestion.
- Question 34Multiple Select
Which statements about Data Collection Endpoints (DCEs) in Microsoft Sentinel are correct? Select all that apply.
- ADCEs provide a central endpoint for data collection.Correct answer
- BDCEs support privacy and network isolation requirements.Correct answer
- CDCEs can alter the schema of built-in tables.
- DDCEs are unnecessary when using Azure Monitor Agent.
Why this is the answer
DCEs provide a central collection endpoint and support privacy and network isolation. They do not modify table schemas.
- Question 35Interactive
Review the table creation statement. Why is this schema definition required for custom log ingestion?
- AThe table must exist with a schema that matches the incoming logs.Correct answer
- BThe table must be archived before logs are sent.
- CThe table plan must be changed to Basic Logs.
- DThe table schema can be added later by a DCR transformation.
Why this is the answer
Custom logs require a Log Analytics table to be created, and the schema should match the logs being collected.
- Question 36Single Choice
An organization needs long-term retention for only a compliance-related log set. What is the best approach?
- AApply long-term retention to the entire workspace.
- BConfigure table-level retention only for the required tables.Correct answer
- CCreate a separate workspace for every compliance requirement.
- DDisable retention for tables that do not require long-term storage.
Why this is the answer
Use table-level retention to target compliance-related tables rather than applying long-term retention to the whole workspace.
- Question 37Multiple Select
Which statements about changing a table plan from Analytics to Basic Logs are correct? Select all that apply.
- ABasic Logs tables support all KQL features exactly like Analytics tables.
- BSome query capabilities are limited in Basic Logs tables.Correct answer
- CBasic Logs tables cannot be queried at all.
- DBasic Logs is suited for verbose logs that do not need advanced analytics.Correct answer
Why this is the answer
Basic Logs is cheaper and suited for verbose logs, but it has limited query capabilities compared to Analytics tables.
- Question 38Interactive
Review the KQL query. The table uses archive retention. Why does the query not return archived data?
- AArchived data must be found by using a search job or restored before regular queries.Correct answer
- BArchive retention prevents all query access, including search jobs.
- CArchived data can be queried only from the workspace UI.
- DRegular KQL queries automatically query archived data.
Why this is the answer
Archive retention stores data outside the normal query store. Use search jobs or restore to access archived data.
- Question 39Single Choice
What happens if a DCR transformation is used to modify the schema of a built-in table such as SecurityEvent?
- AThe transformation can add custom columns to built-in tables.
- BThe transformation can remove columns from built-in tables.
- CBuilt-in table schemas are fixed and cannot be altered by DCR transformations.Correct answer
- DBuilt-in table schemas can be replaced by custom tables.
Why this is the answer
Built-in tables like SecurityEvent have fixed schemas. DCR transformations cannot add or remove their columns.
- Question 40Multiple Select
Which statements correctly describe the Microsoft Defender XDR connector and individual solution-based connectors? Select all that apply.
- AThe Microsoft Defender XDR connector collects related signals across Microsoft Defender services.Correct answer
- BThe Microsoft Defender XDR connector is identical to every individual solution connector.
- CSpecific sources may still require their own solution-based connectors.Correct answer
- DEvery solution connector can be enabled with Microsoft Sentinel Contributor alone.
Why this is the answer
The XDR connector unifies Defender signals, but it is not identical to individual solution connectors; some sources need separate connectors.
- Question 41Interactive
The connector catalog does not include the source shown in the code. What should be done?
- ASelect a similar built-in connector and use it for ContosoSecurityApp.
- BUse a custom connector or alternate ingestion method for ContosoSecurityApp.Correct answer
- CEnable ContosoSecurityApp with the built-in Defender XDR connector.
- DAssign the Microsoft Sentinel Contributor role to enable the built-in connector.
Why this is the answer
A source not in the catalog cannot be handled by a mismatched built-in connector; use custom ingestion.
Frequently asked questions
Everything about the Microsoft Certified: Security Operations Analyst Associate question bank and how to use it.