SC-200 Mitigate threats using Microsoft Sentinel Practice Question
This SC-200 practice question tests your understanding of mitigate threats using microsoft sentinel. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: incident grouping prevents duplicate incidents for recurring alerts.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A SOC analyst in Microsoft Sentinel is creating a scheduled analytics rule to detect anomalous Microsoft Entra ID sign-ins. The rule runs every 5 minutes and queries the SigninLogs table for sign-ins from IP addresses outside the organization's known country codes. To avoid duplicates, the rule should generate an incident only once for a particular user-IP combination until the combination is not seen for 60 minutes. Which configuration should the analyst use in the analytics rule wizard?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incident settings tab - Grouping configuration
Option C is correct because the Incident settings tab's Grouping configuration allows you to group alerts into a single incident based on specific criteria, such as user-IP combination, and to suppress re-creation of an incident for a defined time window (e.g., 60 minutes) after the last occurrence. This directly addresses the requirement to avoid duplicate incidents for the same user-IP pair until it is not seen for 60 minutes.
Key principle: Incident grouping prevents duplicate incidents for recurring alerts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Alert details section
Why it's wrong here
Alert details define the alert output, not duplicate prevention.
✗
Query scheduling section
Why it's wrong here
Query scheduling controls run frequency and lookback, not the incident grouping logic.
✓
Incident settings tab - Grouping configuration
Why this is correct
The grouping configuration allows resetting the grouping window, preventing duplicate incidents for repeated events within that window.
Related concept
Incident grouping prevents duplicate incidents for recurring alerts.
✗
Entity mapping section
Why it's wrong here
Entity mapping links events to entities but does not control incident creation deduplication.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse the Query scheduling section's 'Run query every' and 'Lookup data from the last' settings with deduplication, not realizing that those control query frequency and data range, not incident grouping or suppression based on entity combinations.
Trap categories for this question
Command / output trap
Alert details define the alert output, not duplicate prevention.
Detailed technical explanation
How to think about this question
The Grouping configuration in Incident settings uses the 'Group alerts into a single incident' toggle and allows you to choose 'Group alerts into a single incident if all entities match' or a custom time window. When you set 'Re-open matching incidents' and specify a 60-minute 'Time window', Sentinel will not create a new incident for the same user-IP combination if one already exists within that window, effectively implementing a deduplication suppression. This is distinct from alert suppression, which would prevent alert creation entirely; here, alerts still fire but are grouped into the same incident.
KKey Concepts to Remember
Incident grouping prevents duplicate incidents for recurring alerts.
Grouping configuration defines when new incidents are created for a rule.
It allows setting a time window for grouping related alerts.
The 'Reopen closed incident' option is crucial for handling re-emerging threats.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Incident grouping prevents duplicate incidents for recurring alerts.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Incident grouping prevents duplicate incidents for recurring alerts. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Review incident grouping prevents duplicate incidents for recurring alerts., then practise related SC-200 questions on the same topic to reinforce the concept.
Mitigate threats using Microsoft Sentinel — This question tests Mitigate threats using Microsoft Sentinel — Incident grouping prevents duplicate incidents for recurring alerts..
What is the correct answer to this question?
The correct answer is: Incident settings tab - Grouping configuration — Option C is correct because the Incident settings tab's Grouping configuration allows you to group alerts into a single incident based on specific criteria, such as user-IP combination, and to suppress re-creation of an incident for a defined time window (e.g., 60 minutes) after the last occurrence. This directly addresses the requirement to avoid duplicate incidents for the same user-IP pair until it is not seen for 60 minutes.
What should I do if I get this SC-200 question wrong?
Review incident grouping prevents duplicate incidents for recurring alerts., then practise related SC-200 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Incident grouping prevents duplicate incidents for recurring alerts.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.