Microsoft Security Solutions
The security solutions domain asks you to place each Microsoft product in the right layer and pick the correct one for a scenario: posture management, threat protection, SIEM/SOAR, or network controls.
Defender for Cloud and Defender XDR
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWP) for Azure, AWS, GCP, and on-premises. It continuously assesses resources against standards such as the Microsoft cloud security benchmark, surfaces findings in Secure Score, and adds paid Defender plans (Servers, Storage, SQL, Containers, App Service, Key Vault, Resource Manager, DNS). Microsoft Defender XDR correlates signals across Defender for Endpoint, Identity, Office 365, Cloud Apps, and Vulnerability Management into incidents and automated investigations.
Sentinel
Microsoft Sentinel is a cloud-native SIEM and SOAR platform. Data connectors ingest logs; analytics rules create incidents; automation rules and playbooks (Logic Apps) respond; workbooks visualize; hunting queries support proactive search. Sentinel is not a replacement for Defender XDR - it aggregates and orchestrates across many sources.
Network and platform controls
NSGs filter traffic by IP and port at subnet or NIC level (L3/L4). Azure Firewall is a managed, stateful firewall with FQDN filtering and threat intelligence. Azure WAF protects HTTP(S) apps at L7 with OWASP rules. DDoS Protection mitigates volumetric attacks; Azure Bastion provides RDP/SSH without public IPs; Key Vault stores secrets, keys, and certificates with HSM backing.
Worked example
A user reports a phishing email. Defender for Office 365 detonates the attachment, Defender XDR correlates the sender with endpoint alerts, and Sentinel opens a single incident with a playbook that disables the account. Reasoning: each product contributes a different signal; choosing Sentinel alone would miss the email signal, and choosing Defender for Cloud would only assess configuration posture.
Traps
Defender for Cloud is not a SIEM; Secure Score measures posture, not compliance certification; NSGs cannot do Azure Firewall's FQDN filtering; Sentinel requires connectors and ingestion before it can detect anything.