Microsoft Security Operations Analyst — Question 29

You have 50 Microsoft Sentinel workspaces.

You need to view all the incidents from all the workspaces on a single page in the Azure portal. The solution must minimize administrative effort.

Which page should you use in the Azure portal?

Answer options

• A. Microsoft Sentinel - Incidents
• B. Microsoft Sentinel - Workbooks
• C. Microsoft Sentinel
• D. Log Analytics workspaces

Correct answer: A

Explanation

The correct answer is A, Microsoft Sentinel - Incidents, as it provides a consolidated view of all incidents across multiple workspaces. The other options do not offer a unified incident view; Workbooks (B) are for reporting, the main Microsoft Sentinel page (C) does not aggregate incidents, and Log Analytics workspaces (D) focus on data querying rather than incident management.