mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC analyst has created a custom scheduled…
A SOC analyst has created a custom scheduled analytics rule in Microsoft Sentinel that runs every hour and generates an incident when a certain pattern is detected. The analyst notices that the same set of events is causing a new incident every hour, leading to duplicates. What should the analyst configure to prevent duplicate incident generation from the same events?
⚠ Common exam trap
Watch out — candidates often confuse alert suppression (preventing duplicate alerts) with incident closing mechanisms (automation rules), leading them to choose Option B instead of the correct suppression setting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the alert suppression setting in the analytics rule
The alert suppression setting in a Microsoft Sentinel scheduled analytics rule allows you to configure a time window during which duplicate alerts from the same events are suppressed. When enabled, Sentinel will not generate a new incident from the same set of events until the suppression window expires, preventing the hourly duplication the analyst observed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the alert suppression setting in the analytics rule
Why this is correct
Alert suppression is a native analytic rule setting in Microsoft Sentinel that prevents duplicate alerts by silencing the rule for a defined period after the first alert fires. When the same events or query results are processed in subsequent scheduled runs within that period, no new alert or incident is created. This is the most efficient method because it eliminates duplication at the source, reducing noise without consuming automation resources or requiring custom KQL logic.
- ✗
Use an automation rule to close duplicates
Why it's wrong here
An automation rule that closes duplicate incidents is inherently reactive because it runs only after the alert has already been generated and an incident created. It requires identification logic based on entity, title, or other fields, which can be fragile and may incorrectly close legitimate distinct alerts. Additionally, the duplicate alert still appears in the alert queue and consumes storage and processing, so it does not address the underlying problem of over-alerting. Thus it is less effective than preventing the generation altogether.
- ✗
Modify the query to use the 'summarize' operator
Why it's wrong here
Using the 'summarize' KQL operator aggregates rows within a single query execution, but it does not perform cross-run deduplication. If the same events remain in the query window on consecutive scheduled runs, summarize produces identical aggregated results each time, leading to repeated alerts. While you could combine summarize with a time-bound lookup to skip previously processed records, that approach is complex, error-prone, and requires maintaining state, whereas the native suppression setting is a one-click solution.
- ✗
Change the query to use the 'take' operator
Why it's wrong here
The 'take' operator simply limits the output to a specified number of rows, which is arbitrary and does not account for the actual volume of matching events. Applying it could silently drop critical alerts if the query returns more than the specified count, causing missed incidents. Crucially, 'take' has no memory of prior query runs, so if the same events are at the top of the result set each time, duplicates still appear. It is neither a deduplication nor a suppression mechanism.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.