easyMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC analyst is configuring a scheduled…
A SOC analyst is configuring a scheduled analytics rule in Microsoft Sentinel. The rule runs every hour and queries the SigninLogs table for failed sign-ins. The analyst wants to avoid generating multiple incidents for the same user and IP address within a 1-hour window. Which configuration should the analyst use in the 'Incident creation' section of the rule?
⚠ Common exam trap
Watch out — candidates often confuse 'Alert per rule run' settings with incident deduplication, mistakenly thinking 'Every event' or disabling grouping will reduce incidents, when in fact only the combination of 'Single alert per run' and enabled grouping with a time window achieves the desired deduplication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set 'Alert per rule run' to 'Single alert per run' and enable 'Grouping' with 'Group all alerts into a single incident' and time window of 1 hour.
Setting 'Alert per rule run' to 'Single alert per run' ensures that all matching query results from a single run are bundled into one alert. Enabling 'Grouping' with 'Group all alerts into a single incident' and a 1-hour time window then merges alerts across multiple runs for the same user and IP into one incident, preventing duplicate incidents within that window. This directly meets the requirement to avoid multiple incidents for the same user and IP within an hour.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set 'Alert per rule run' to 'Single alert per run' and enable 'Grouping' with 'Group all alerts into a single incident' and time window of 1 hour.
Why this is correct
With 'Single alert per run' and grouping enabled, the rule generates one alert per scheduled run, and the alert grouping engine then combines all alerts produced during the 1-hour grouping window into a single incident. This prevents duplicate incidents for recurring detections within that window, consolidating related alerts so analysts investigate one incident instead of many. It also preserves the ability to see the full scope of activity within the incident.
- ✗
Set 'Alert per rule run' to 'Every event' and disable grouping.
Why it's wrong here
Choosing 'Every event' causes the rule to generate a separate alert for each event that matches the query, which is resource-intensive and can flood the alerts queue during high-volume bursts. Because grouping is disabled, each alert is automatically converted into its own incident, so a single attack pattern can produce dozens or hundreds of separate incidents that must be triaged independently. This directly contradicts the goal of avoiding duplicate incidents and creates an operational alert storm.
- ✗
Set 'Alert per rule run' to 'Single alert per run' and disable grouping.
Why it's wrong here
This creates one alert per rule run but does not use grouping; if the rule runs every hour, each hour's alert becomes a separate incident, but events within that hour are not grouped across runs.
- ✗
Configure the rule to use 'Supply chain' analytics rule type.
Why it's wrong here
'Supply chain' is not a valid analytics rule type in Microsoft Sentinel; the actual rule types are Scheduled, NRT, Microsoft Security, and ML Behavior Analytics, so this option references a nonexistent configuration. Even if a supply-chain template existed, selecting a different rule type would not adjust the alert-per-rule-run or incident grouping settings, because those are properties of the scheduled rule's configuration. Therefore this option cannot produce the desired behavior of consolidating alerts into a single incident.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.