Correct Answer:

Explanation:
https://learn.microsoft.com/en-us/training/modules/describe-insider-risk-capabilities-microsoft-365/2-management-solution Triage - New activities that need investigation automatically generate alerts that are assigned a Needs review status. Reviewers in the organization can quickly identify these alerts and scroll through each to evaluate and triage. As part of the triage process, reviewers can view alert details for the policy match, view user activity associated with the match, see the severity of the alert, and review user profile information.
Investigate - Cases are created for alerts that require deeper review and investigation of the details and circumstances around the policy match. The Case dashboard provides an all-up view of all active cases, open cases over time, and case statistics for the organization.
Action - After cases are investigated, reviewers can quickly act to resolve the case or collaborate with other risk stakeholders in the organization.

Correct Answer:

Explanation:
Box 1: No
Microsoft Sentinel is an open enterprise SIEM. It provides native connectors for a massive list of third-party vendors (such as AWS, Cisco, Palo Alto, and Fortinet) alongside standard Syslog and CEF ingestion.
Box 2: Yes
Once you have connected your data sources to Microsoft Sentinel, you can visualize and monitor the data using the Microsoft Sentinel adoption of Azure Monitor Workbooks, which provides versatility in creating custom dashboards. While the Workbooks are displayed differently in Microsoft Sentinel, it may be useful for you to see how to create interactive reports with Azure Monitor Workbooks. Microsoft Sentinel allows you to create custom workbooks across your data, and also comes with built-in workbook templates to allow you to quickly gain insights across your data as soon as you connect a data source.
Box 3: Yes
To help security analysts look proactively for new anomalies that weren't detected by your security apps or even by your scheduled analytics rules, Microsoft Sentinel's built-in hunting queries guide you into asking the right questions to find issues in the data you already have on your network.
Reference:
https://docs.microsoft.com/en-us/azure/sentinel/data-connectors-reference
https://docs.microsoft.com/en-us/azure/sentinel/monitor-your-data https://docs.microsoft.com/en-us/azure/sentinel/hunting

Correct Answer:

Explanation:
https://learn.microsoft.com/en-us/azure/sentinel/overview#create-interactive-reports-by-using-workbooks After you onboard to Microsoft Sentinel, monitor your data by using the integration with Azure Monitor workbooks.
Workbooks display differently in Microsoft Sentinel than in Azure Monitor. But it may be useful for you to see how to create a workbook in Azure Monitor. Microsoft Sentinel allows you to create custom workbooks across your data. Microsoft Sentinel also comes with built-in workbook templates to allow you to quickly gain insights across your data as soon as you connect a data source.

Correct Answer:

Explanation:
Microsoft Entra Permissions Management can handle permission classifications. It provides a CIEM solution that helps organizations discover, monitor, and remediate permission risks across multi-cloud environments. Specifically, Entra Permissions Management allows for classifying permissions, which is done on the ServicePrincipal object of the API that publishes the permissions. This allows for better organization, analysis, and management of permissions across your cloud infrastructure.
Manage permission classifications. Follow these steps to classify permissions using the Microsoft Entra admin center: Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator. Browse to Entra ID > Enterprise apps > Consent and permissions > Permission classifications Reference:
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-permission-classifications