Microsoft MS-SENTINEL Practice Test

MS-SENTINEL practice test: what's covered

• Cloud-Native SIEM + SOAR
• KQL
• Analytics Rules
• Playbooks
• Workbooks

Free MS-SENTINEL sample questions

1. Microsoft Sentinel is BEST described as:

   • A. An on-prem appliance SIEM
   • B. A cloud-native SIEM + SOAR built on top of an Azure Log Analytics workspace — providing data ingestion, detection (analytics), investigation, and automated response at cloud scale
   • C. An antivirus product
   • D. A firewall OS
   Show answer

   Correct: B. Sentinel = cloud-native SIEM (collect + detect + investigate) and SOAR (automate response). It runs on a Log Analytics workspace for storage/query. No infrastructure to manage; scales elastically. Distinct from endpoint AV/firewalls.

2. The storage/query backbone that Microsoft Sentinel is enabled ON is:

   • A. A SQL Server database
   • B. An Azure Log Analytics workspace — logs are ingested into tables there, and KQL queries run against it
   • C. A BGP router
   • D. An on-prem file share
   Show answer

   Correct: B. Sentinel is enabled on a Log Analytics workspace. All ingested data lands in workspace tables (SecurityEvent, SigninLogs, etc.), queried with KQL. Workspace design (region, retention, RBAC) underpins everything Sentinel does.

3. Which TWO are workspace design considerations for Sentinel? (Choose 2)

   • A. Data residency / region of the workspace
   • B. Data retention period and RBAC scoping (who can read which data)
   • C. BGP AS number
   • D. Printer toner level
   Show answer

   Correct: A and B. Workspace decisions: region (residency/latency), retention (cost vs investigation look-back), and access control (table/resource-context RBAC). Single vs multi-workspace also matters for multi-tenant/MSSP. BGP/toner are irrelevant.

4. Sentinel pricing is primarily driven by:

   • A. Number of users only
   • B. Data INGESTION volume (and retention) — you pay largely per GB ingested/analyzed, so connector selection and noisy-log filtering directly affect cost
   • C. BGP routes
   • D. Number of dashboards
   Show answer

   Correct: B. Sentinel/Log Analytics cost is mostly per-GB ingested (+ retention). This makes connector choice and filtering noisy/low-value logs a real cost-control discipline. Commitment (capacity) tiers reduce per-GB cost at volume.

5. A "commitment tier" (capacity reservation) in Sentinel/Log Analytics is used to:

   • A. Increase cost
   • B. Get a discounted per-GB rate by committing to a daily ingestion volume — cheaper than pay-as-you-go for predictable high-volume environments
   • C. Configure BGP
   • D. Add more dashboards
   Show answer

   Correct: B. Commitment tiers reserve a daily GB capacity at a reduced rate. For steady high-volume ingestion, this saves money vs pay-as-you-go. Right-size the tier to typical ingest to balance savings against overage.

Last updated: 2026-10-19

MS-SENTINEL practice test FAQ

Related practice tests

• Microsoft SC-200 practice test
• Microsoft Defender XDR practice test
• Security Copilot SOC analyst practice test
• Microsoft SC-100 practice test
• Splunk SPLK-1001 practice test
• CySA+ CS0-003 practice test