Explanation:
Box 1: Monthly
Windows supports monthly node image version upgrades.
Box 2: Weekly
Linux supports weekly node image version upgrades.
Note: Azure Kubernetes Service patch and upgrade guidance
This section of the Azure Kubernetes Service (AKS) day-2 operations guide describes patching and upgrading strategies for AKS worker nodes and Kubernetes versions. As a cluster operator, you need to have a plan for keeping your clusters up to date and monitoring Kubernetes API changes and deprecations over time.
Reference:
https://learn.microsoft.com/en-us/azure/architecture/operator-guides/aks/aks-upgrade-practices

If a ransomware attack is detected the affected entity should immediately activate its security incident response plan, which should include measures to isolate the infected computer systems in order to halt propagation of the attack.
Note: Isolate devices from the network
Depending on the severity of the attack and the sensitivity of the device, you might want to isolate the device from the network. This action can help prevent the attacker from controlling the compromised device and performing further activities such as data exfiltration and lateral movement.
Reference:
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-machine- alerts?view=o365-worldwide#isolate-devices-from-the- network

Explanation:
Box 1: Exchange Online Protection (EOP)
Ransomware protection in Microsoft 365
Teams
Teams chats are stored within Exchange Online user mailboxes and files are stored in either SharePoint or OneDrive. Microsoft Teams data is protected by the controls and recovery mechanisms available in these services.
Box 2: The Preservation Hold library
Preservation Hold library: Files stored in SharePoint or OneDrive sites can be retained by applying retention settings. When a document with versions is subject to retention settings, versions get copied to the Preservation Hold library and exist as a separate item. If a user suspects their files have been compromised, they can investigate file changes by reviewing the retained copy. File Restore can then be used to recover files within the last 30 days.
Reference:
https://learn.microsoft.com/en-us/compliance/assurance/assurance-shared-ransomware- protection

Explanation:
Box 1: 3
Number of workspace
One for Sub2, one for Sub3, and one for Sub4.
Note: Extend Microsoft Sentinel across workspaces and tenants
When you onboard Microsoft Sentinel, your first step is to select your Log Analytics workspace.
While you can get the full benefit of the Microsoft Sentinel experience with a single workspace, in some cases, you might want to extend your workspace to query and analyze your data across workspaces and tenants.
Box 2: Azure Lighthouse
Service
Manage workspaces across tenants using Azure Lighthouse
As mentioned above, in many scenarios, the different Log Analytics workspaces enabled for Microsoft Sentinels can be located in different Microsoft Entra tenants. You can use Azure Lighthouse to extend all cross-workspace activities across tenant boundaries, allowing users in your managing tenant to work on workspaces across all tenants.
Once Azure Lighthouse is onboarded, use the directory + subscription selector on the Azure portal to select all the subscriptions containing workspaces you want to manage, in order to ensure that they'll all be available in the different workspace selectors in the portal.
When using Azure Lighthouse, it's recommended to create a group for each Microsoft Sentinel role and delegate permissions from each tenant to those groups.
Reference:
https://learn.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants
https://learn.microsoft.com/en-us/azure/sentinel/multiple-tenants-service-providers