Microsoft Sentinel is a cloud-native, scalable solution that integrates two primary security functions. First, it serves as a Security Information and Event Management (SIEM) system, collecting and analyzing security data from various sources across the enterprise to detect threats. Second, it provides Security Orchestration, Automation, and Response (SOAR) capabilities. This allows organizations to automate responses to security incidents using playbooks, which significantly reduces response times and manual effort for security operations teams.

A. This describes Microsoft Secure Score, a feature in Microsoft 365 Defender and Microsoft Defender for Cloud that measures security posture, not a core function of Microsoft Sentinel.
C. This capability is more aligned with Microsoft 365 Lighthouse, a portal designed for Managed Service Providers (MSPs) to manage their customers' services, devices, and users at scale.

1. Microsoft Learn. (2024). What is Microsoft Sentinel? Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/azure/sentinel/overview. In the "What is Microsoft Sentinel?" section, paragraph 1 states, "Microsoft Sentinel is a scalable, cloud-native solution that provides: Security information and event management (SIEM) [and] Security orchestration, automation, and response (SOAR)."

2. Microsoft Learn. (2024). Describe the security capabilities of Microsoft Sentinel - MS-900. Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/training/modules/describe-security-capabilities-microsoft-sentinel/. In the "Introduction" unit, paragraph 2 explicitly defines Microsoft Sentinel as "a security information and event management (SIEM) and security orchestration, automated response (SOAR) solution."