Follow the evidence output
A SIEM supports collecting and analyzing security information and investigating possible incidents across connected sources. SOAR concerns orchestration, automation and response. Sentinel includes capabilities serving both purposes. A question may therefore ask which part of the workflow supplies the next required output, rather than which product appears anywhere in the overall story. Identify what information already exists and what must happen next: ingestion, correlation, proactive search, visualization or an approved recurring response task.
Collection and correlation
Data connectors bring supported source information into the analysis environment. Normalization can present differently structured data in a more uniform view. Analytics can connect related alerts about entities into potential incidents. A connector alone does not perform all that correlation merely because its data is now available. Conversely, an analytics rule does not establish that an unconnected source’s data is present. Keep data availability separate from interpretation. This lesson does not promise that every source is automatically available or that connecting data detects every threat.
Investigation and recurring work
Hunting tools support proactive query-based examination before an alert for a pattern exists. Incident investigation helps examine entities and connections to understand a potential threat. Workbooks visualize collected evidence. Automation rules and playbooks support recurring enrichment, response and related orchestration work. These functions can complement each other. A workbook may help an analyst understand evidence, but a visual display is not itself the workflow that carries out an approved response. An activity being automatic does not make it analytically conclusive.
Worked example
Fictional teaching case: a transit museum has an approved procedure for enriching a security incident with relevant reference information and assigning it to the appropriate team. The event source is already connected, and the incident already exists. The new request is to orchestrate that recurring procedure. Select Sentinel SOAR automation rather than another connector or a dashboard. Challenge the closest alternative: a dashboard could show assignment information, but displaying that information does not execute the approved assignment workflow. The answer follows the next required output, not a generic desire to use automation.
Transfer check
Now a fictional analyst suspects a previously unalerted pattern in data already connected to Sentinel and wants to proactively examine it. Is the previous answer still the direct fit? Check basis: no. Hunting search-and-query tools address this investigative task. There is no existing recurring response procedure to execute in the new case. If source data were missing, ingestion would become a prerequisite; the statement that data is already connected is therefore a meaningful condition rather than decorative background.
Verify the workflow boundary
For each answer, name the input and output. Connected records support analysis; potential incidents support investigation; an approved repetitive task can support orchestration. These are capabilities, not guarantees of detection or authorized autonomous remediation. No query syntax, attack procedure, connector creation or real response is performed here. Preserve uncertain incident conclusions until the relevant evidence has been investigated.
Try it, then explain it.
Complete a short set without looking at the example. After each answer, explain which evidence or rule supports your decision and why the alternatives do not fit.
Sources & authorship
Original OpenExam explanations and examples. References support the concepts; they are not the source of copied questions. Independent educator review is pending.
What is Microsoft Sentinel SIEM? | Microsoft LearnAutomation in Microsoft Sentinel | Microsoft Learn