hardMultiple ChoiceObjective-mapped
SC-100 Contoso Ltd Practice Question
Contoso Ltd. is a multinational organization with a hybrid environment consisting of on-premises Active Directory and Azure AD (now Microsoft Entra ID). They use Microsoft Defender for Cloud Apps, Microsoft Sentinel, and Microsoft 365 Defender. The security operations team has noticed that several high-severity alerts from Microsoft 365 Defender are not being forwarded to Microsoft Sentinel, causing delayed response. The team has confirmed that the data connector between Microsoft 365 Defender and Sentinel is enabled and appears healthy. However, only low-severity alerts appear in Sentinel. Further investigation reveals that the Microsoft 365 Defender portal has a configured rule set that suppresses high-severity alerts for certain users deemed low risk. The security operations manager wants to ensure all high-severity alerts are sent to Sentinel without changing the suppression rules in Microsoft 365 Defender, as those rules are required for operational efficiency. What should the team do to ensure high-severity alerts are ingested into Sentinel?
⚠ Common exam trap
A common mix-up: candidates assume suppressed alerts are permanently hidden and cannot be ingested, leading them to choose either modifying the suppression rules (Option A) or building a custom workaround (Option D), when in fact the Sentinel connector has a specific toggle to include suppressed alerts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the Microsoft 365 Defender data connector in Sentinel, enable the option to include suppressed alerts.
The Microsoft 365 Defender data connector in Microsoft Sentinel includes a configuration setting to 'Include suppressed alerts.' Enabling this option forces Sentinel to ingest all alerts from Microsoft 365 Defender, including those that are suppressed by rule sets in the Defender portal. This satisfies the requirement to forward high-severity alerts without modifying the suppression rules that the operations team relies on for operational efficiency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the suppression rules in Microsoft 365 Defender to not suppress high-severity alerts.
Why it's wrong here
Changing suppression rules in Microsoft 365 Defender directly alters the alert lifecycle and could hide legitimate high-severity threats from defenders who rely on the native console. The manager explicitly wants to keep those rules unchanged, and this option would not fix the Sentinel ingestion gap because the connector's include-suppressed-alerts setting is a separate toggle that can be enabled independently. Suppression rules are designed to reduce noise for analysts, not to block data from flowing to SIEM tools; overriding them globally would degrade the security team's operational workflow without addressing the root cause.
- ✓
In the Microsoft 365 Defender data connector in Sentinel, enable the option to include suppressed alerts.
Why this is correct
The Microsoft 365 Defender data connector in Microsoft Sentinel includes a configuration option called 'include suppressed alerts' that, when enabled, ingests all alerts regardless of their suppression status in Defender. This setting is the intended, supported mechanism to ensure high-severity alerts that are suppressed in the Defender console still appear in Sentinel for correlation, hunting, and incident response. Enabling this option preserves the existing suppression rules for day-to-day analyst workflows while giving Sentinel full visibility, exactly satisfying the manager's requirement to keep suppression rules unchanged and preventing missed alerts.
- ✗
Use the Microsoft Graph Security API connector in Sentinel to ingest alerts instead.
Why it's wrong here
Switching to the Microsoft Graph Security API connector would not solve the suppression problem because that connector has its own alert-handling behavior and may still honor suppression logic, resulting in the same missing data. More importantly, running both the Defender connector and the Graph Security API connector simultaneously would ingest overlapping alert sets, creating duplicate incidents and wasting storage and processing resources. The current Defender connector already provides a direct and configurable path to include suppressed alerts, so replacing it with an alternative connector adds complexity and data inconsistency without any benefit.
- ✗
Create a separate Logic App to fetch high-severity alerts from Microsoft 365 Defender API and send them to Sentinel.
Why it's wrong here
Building a separate Logic App to fetch high-severity alerts from the Microsoft 365 Defender API and push them into Sentinel is an unnecessary custom solution that duplicates data already available through the native connector. This approach introduces extra operational overhead, including API throttling management, error handling, and credential storage, while the existing Defender data connector can be configured with a single checkbox to include suppressed alerts. It would also break the built-in connectivity and schema mapping, potentially causing duplicate incidents with the normal alert stream and making the Logic App a fragile, redundant component that adds no analytical value.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.