2. Manage a Security Operations Environment (40–45%)

This is the heaviest domain on the exam, and it is configuration work: building the platform that Phase 1 described. The order of this phase follows the order data and decisions actually flow. First you set up the Sentinel platform itself, deciding who can do what and where data lives (2.1). Then you get data in (2.2). Then you configure Defender for Endpoint, the richest native sensor (2.3), and Defender XDR's notification, investigation, and disruption machinery (2.4). With data flowing, you write detections (2.5), and finally you automate the response (2.6). Read every scenario in this phase through one question: where in that pipeline is the requirement, and which setting at that point satisfies it with the least effort and least privilege?

Think of this phase as building a factory line: roles and tiers are the floor plan, connectors are the loading dock, detections are quality control, and automation is the conveyor that moves work without anyone carrying it.

⚠️ Exam Trap: Over-privileged answers (Global Administrator, Owner, Sentinel Contributor for someone who only triages) and over-broad fixes (disabling a detection, excluding a whole folder) are the most common distractors in this domain.