4. Capabilities of Microsoft Security Solutions (35-40%)

This is the largest domain on the exam — over a third of your score. It covers four distinct layers: the core network/infrastructure controls in Azure, the posture-management tools that keep those controls configured correctly, Microsoft Sentinel's SIEM/SOAR capabilities, and the Defender XDR family that detects and responds to active threats. Notice the progression: prevent (4.1), continuously assess (4.2), detect and correlate at scale (4.3), and respond across every surface (4.4).