Explanation:

In Microsoft Sentinel, Logic Apps are used as playbooks for automation and orchestration (SOAR)-to take actions after alerts/incidents occur (notify, enrich, remediate). They are not the component that detects or identifies anomalies; detections come from analytics rules, UEBA (user and entity behavior analytics), Fusion (ML-powered correlation), and anomaly rules. Workbooks are interactive dashboards and visualizations for monitoring and reporting; they don't correlate alerts. Correlation of alerts into incidents is handled by analytics rules (including alert grouping and Fusion) within Sentinel's detection pipeline. Finally, Sentinel's Hunting experience provides KQL-based queries and templates that are mapped to the MITRE ATT & CK tactics/techniques, enabling analysts to explore threats in a framework-aligned way. Thus, automation via Logic Apps # anomaly detection; Workbooks # incident correlation; Hunting tooling does align to MITRE ATT & CK.

Azure Firewall is a managed, cloud-based network security service designed to secure traffic inside and across Azure Virtual Networks. Microsoft describes Azure Firewall as a stateful firewall that "protects Azure Virtual Network resources" by enforcing network and application rules, central logging, and threat intelligence-based filtering. Because it is deployed into a VNet/subnet (often as the hub in a hub-and-spoke), it directly governs East/West and North/South flows to workloads such as Azure virtual machines and platform services reachable through the VNet, using DNAT/SNAT and rule collections. Microsoft guidance highlights capabilities to "centrally create, enforce, and log application and network connectivity policies across subscriptions and virtual networks," and to filter traffic for peered VNets, branch connections (VPN
/ExpressRoute), and internet traffic. These capabilities explicitly map to protecting Azure virtual networks and the VMs and subnets inside them. In contrast, Azure AD users, Exchange Online inboxes, and SharePoint Online sites are SaaS/identity resources protected by Microsoft Entra controls, Exchange/SharePoint security, and Purview/Defender for Office 365-not by a VNet firewall. Therefore, the Azure Firewall-protectable resource types among the options are Azure virtual machines and Azure virtual networks.

In Microsoft Defender for Cloud, the Free plan provides continuous security assessment and visibility into your posture via Secure Score and security recommendations. Microsoft explains that the free tier offers
"foundational CSPM capabilities," including recommendations and a security score (Secure score) to help you prioritize hardening tasks. Advanced features-such as vulnerability scanning for VMs (Qualys-based), Just- In-Time (JIT) VM access, and threat protection alerts-require the enhanced/paid Defender plans (for example, Defender for Servers). Consequently, among the listed options, only Secure score is available in the free mode. This score aggregates the effect of recommendations across subscriptions and resources so you can track and improve security posture without enabling any of the paid Defender plans.

In Microsoft's identity platform, Active Directory Domain Services (AD DS) is the on-premises directory that maintains directory objects such as users, groups, and computers. Microsoft documentation describes AD DS as a service that "stores information about objects on the network and makes this information easy for administrators and users to find and use." It further explains that AD DS contains objects like "users, groups, computers, and other resources," and that administrators use tools such as Active Directory Users and Computers to create and manage these objects. A key object type is the computer account; Microsoft states that "a computer that's joined to a domain has a corresponding computer account object in Active Directory" and that these accounts are created and managed within AD DS to enable secure authentication and authorization for domain-joined devices.
By contrast, mobile devices are typically enrolled and managed through Microsoft Intune/Endpoint Manager and Azure AD device objects, not created in AD DS. Likewise, SaaS applications that require modern authentication integrate with Microsoft Entra ID (Azure AD) using OpenID Connect/OAuth 2.0-not with AD DS. Line-of-business apps that rely on modern authentication are also registered in Entra ID, while AD DS supports traditional Kerberos/NTLM for domain resources. Therefore, among the options provided, the object you can create in AD DS is computer accounts.

https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of Privileged Identity Management: Provide just-in-time privileged access to Azure AD and Azure resources Assign time-bound access to resources using start and end dates Require approval to activate privileged roles Enforce multi-factor authentication to activate any role Use justification to understand why users activate Get notifications when privileged roles are activated Conduct access reviews to ensure users still need roles Download audit history for internal or external audit Prevents removal of the last active Global Administrator role assignment