Question
You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled.
The Azure subscription contains a Microsoft Sentinel workspace. Microsoft Sentinel data connectors are configured for Microsoft 365, Microsoft 365 Defender,
Defender for Cloud, and Azure.
You plan to deploy Azure virtual machines that will run Windows Server.
You need to enable extended detection and response (EDR) and security orchestration, automation, and response (SOAR) capabilities for Microsoft Sentinel.
How should you recommend enabling each capability? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Explanation
EDR: Onboard the servers to Defender for Cloud. Enabling Microsoft Defender for Servers on the Azure virtual machines deploys the integrated Microsoft Defender for Endpoint sensor, which provides endpoint detection and response; the resulting alerts already reach Microsoft Sentinel through the existing Defender for Cloud and Microsoft 365 Defender connectors. Azure Arc is only needed for servers outside Azure, and the Azure AD and Defender for Cloud Apps connectors bring identity and SaaS data, not endpoint detection.
SOAR: Configure Microsoft Sentinel playbooks. Playbooks are Azure Logic Apps workflows that Microsoft Sentinel runs from automation rules to respond to incidents and alerts, which is its security orchestration, automation, and response capability. Analytics rules detect threats rather than automate responses, and regulatory compliance standards and workflow automation in Defender for Cloud are not SOAR capabilities of Microsoft Sentinel.
