SC-200 Respond to security incidents Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Assign incidents to analysts or teams

  Why this is correct

  Assigning incidents to analysts or teams is a core incident management capability in Microsoft Sentinel. Through the Incident blade, an analyst can set the Owner and assign the incident to a specific person or group, establishing accountability and routing for follow-up actions. Assignment does not change incident state by itself but ensures each case has a clear point of contact.

• ✓

  Classify incidents as true positive, false positive, or benign positive

  Why this is correct

  Classifying incidents as true positive, false positive, or benign positive is a distinct incident management action used to record the disposition of an investigation. In Microsoft Sentinel, the analyst selects a classification and an optional reason, which feeds metrics and helps tune analytics rules to reduce noise. This classification is a judgment applied to a closed or resolved incident, not an automated or reporting function.

• ✓

  Merge related incidents into a single incident

  Why this is correct

  Merging related incidents is an incident management capability that consolidates two or more incidents into a single entity when they represent the same underlying threat or investigation. In Sentinel, the Merge action appears for multiple incidents with similar disposition criteria, and the merged result retains all associated alerts and owner information. Merging reduces duplication and allows analysts to handle a coordinated attack as one case rather than several disjoint entries.

• ✗

  Create playbooks to automate incident response

  Why it's wrong here

  Creating playbooks is a form of automation rather than incident management, because playbooks are Azure Logic Apps workflows that execute automated response actions when triggered. While playbooks can automate tasks that support incident handling (such as changing status or adding comments), the act of creating them belongs to the Automation and Logic Apps design experience, not to the day-to-day management of an individual incident. Incident management capabilities are those directly applied to existing incidents, like assignment and classification, whereas playbook creation is a build-time activity.

• ✗

  Create workbooks to visualize incident trends

  Why it's wrong here

  Creating workbooks is a reporting and visualization activity rather than an incident management action. Workbooks in Microsoft Sentinel are interactive dashboards that aggregate KQL queries to display trends, detection health, and incident metrics over time. Adding or editing a workbook is done in the Workbooks blade to support monitoring and communication, but it does not directly assign, classify, merge, or otherwise operate on a specific incident.

Go deeper

Related to this question