The TryHackMe MS Sentinel: Deploy Room is MAX only subscriber room from TryHackMe and is part of their Defending Azure Training Path. The room is available at: https://tryhackme.com/room/sentineldeploy
1.1 Is Microsoft Sentinel a resource or a service?
Answer: Service
1.2 What is a potential concern due to logs travelling across the Azure regions?
Answer: Bandwidth costs
2.1 What does a Log Analytics workspace, where log data from different sources is aggregated, essentially serve as?
Answer: Centralized repository
2.2 How can we also refer to a Log Analytics workspace once Microsoft Sentinel is enabled on it?
Answer: Microsoft Sentinel workspace
3.1 What permissions do you need to enable Microsoft Sentinel?
Answer: Microsoft Sentinel Contributor
3.2 Do you need to have a Log Analytics workspace created before you can enable/onboard Microsoft Sentinel? (yea/nay)
Answer: Yea
3.3 While creating a LAW instance, which setting defines where the log data will reside?
Answer: Region
4.1 Is every Log Analytics workspace a Microsoft Sentinel workspace? (Yea/Nay)
Answer: Nay
4.2 What do you need to create before enabling or onboarding Microsoft Sentinel?
Answer: Log Analytics workspace.
5.1 You are an incident responder who needs to manage incidents, such as assigning and dismissing them. Which role do you need?
Answer: Microsoft Sentinel Responder
5.2 You are a security engineer, and you are tasked with enabling pre-packaged Solutions from Content Hub. Which role do you need?
Answer: Microsoft Sentinel Contributor
5.3 You are the CISO of the organization. You need visibility into Sentinel data, but you don’t directly manage the Sentinel environment. Which role do you need?
Answer: Microsoft Sentinel Reader
6.1 How many sets of settings are there for Microsoft Sentinel?
Answer: 2
6.2 Can Data Retention settings be found under Microsoft Sentinel workspace settings? (Yea/Nay)
Answer: Yea
6.3 Under which subcategory of settings are the Data Retention settings tucked in?
Answer: Usage and estimated costs
