SC-200 Manage a security operations environment Practice Question
A company uses Microsoft Sentinel with the Microsoft 365 Defender connector. The security team notices that alerts from Microsoft Defender for Endpoint (MDE) are not appearing in Sentinel. The MDE data connector status shows 'Connected'. Which step should you take to troubleshoot this issue?
⚠ Common exam trap
Watch out — candidates often assume a 'Connected' status guarantees data flow, but the connector status only reflects the API connection to Microsoft 365 Defender, not the actual generation or forwarding of alerts from the underlying MDE service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the Microsoft 365 Defender portal to ensure MDE alerts are being generated and forwarded to Microsoft 365 Defender.
The Microsoft 365 Defender connector in Microsoft Sentinel ingests alerts that have already been generated and forwarded by Microsoft Defender for Endpoint (MDE) to the Microsoft 365 Defender portal. Even if the connector status shows 'Connected', if MDE alerts are not being generated or forwarded to Microsoft 365 Defender (e.g., due to a licensing issue, misconfigured alert policy, or service health problem), they will never reach Sentinel. Therefore, the first troubleshooting step is to verify alert generation and forwarding at the source in the Microsoft 365 Defender portal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Verify that the Microsoft 365 Defender connector is configured to ingest MDE alerts.
Why it's wrong here
The Microsoft 365 Defender data connector in Sentinel operates as a unified pipeline that pulls all security alerts and incidents from Microsoft 365 Defender without offering per-source toggles. There is no separate configuration switch to selectively enable or disable ingestion of Microsoft Defender for Endpoint (MDE) alerts. Therefore, verifying a specific setting for MDE alert ingestion is not a valid troubleshooting step because the connector's design ingests all available alert types automatically once enabled.
- ✗
Check if the Microsoft Defender for Endpoint data connector is added.
Why it's wrong here
In Microsoft Sentinel, there is no stand-alone 'Microsoft Defender for Endpoint' data connector; alerts from Defender for Endpoint are forwarded through the Microsoft 365 Defender connector, which consolidates signals from all Microsoft Defender workload suites. Checking for a dedicated MDE connector is ineffective because such an entity does not exist in the current connector catalog. The absence of alerts in Sentinel would not be caused by a missing separate connector, but rather by an upstream collection or forwarding failure.
- ✗
Verify that the ingestion rules in Sentinel are not filtering out MDE alerts.
Why it's wrong here
Sentinel ingestion rules (also known as data collection rules) are applied to data after it has already been received by the Log Analytics workspace, so they can only filter or transform events that are present. Since no MDE alerts are appearing from the Microsoft 365 Defender connector, the problem exists before ingestion starts, meaning the alerts are not being generated or forwarded from the source. Conclusion: ingestion rules could not be responsible for the complete lack of data because they cannot act on data that never arrives.
- ✓
Check the Microsoft 365 Defender portal to ensure MDE alerts are being generated and forwarded to Microsoft 365 Defender.
Why this is correct
Before troubleshooting Sentinel, verify that Microsoft Defender for Endpoint alerts are actually being produced and sent to Microsoft 365 Defender by reviewing the Microsoft 365 Defender portal. If no MDE alerts are visible there, they cannot propagate downstream to Sentinel, regardless of connector configuration. This is the root-cause check because the Microsoft 365 Defender connector only ingests what Microsoft 365 Defender itself has received and correlated; an empty source yields empty Sentinel tables.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.