SC-200 Respond to security incidents Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Hunting query results

  Why it's wrong here

  Hunting queries are interactive, investigator-led searches performed in the Hunting blade of Microsoft Sentinel. They return matching entities and events but do not, by themselves, generate incidents; the output is only a temporary view. To turn a useful hunt into an incident, you must either manually create one or convert the query into a scheduled analytics rule that triggers incidents automatically.

• ✓

  Microsoft 365 Defender alerts

  Why this is correct

  Microsoft 365 Defender alerts are a legitimate incident source when you have the Microsoft 365 Defender data connector enabled in Sentinel. This connector automatically ingests high-fidelity alerts from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. The connector's incident creation setting then creates an incident each time one of these alerts is ingested, plus any related alerts are grouped into the same incident.

• ✓

  Analytics rule triggering

  Why this is correct

  Analytics rules include both scheduled query rules and Microsoft security rule templates that evaluate log data on a regular basis. When the rule's query returns a result that meets its trigger threshold or condition, the rule fires an alert and creates a corresponding incident in Sentinel. This makes rule triggering the core, automatic mechanism for incident generation from both raw logs and ingested security alerts.

• ✗

  Workbook creation

  Why it's wrong here

  Workbooks in Microsoft Sentinel are interactive dashboards built on Azure Monitor workbooks, used for visualizing and analyzing metrics and logs. Creating or refreshing a workbook only runs queries and renders results; it has no detection or alerting logic that could produce an incident. Therefore, workbook creation is not a source of incidents but rather a reporting and investigative aid.

• ✗

  Playbook execution

  Why it's wrong here

  Playbooks are cloud workflows (built on Azure Logic Apps) that execute in response to a trigger such as an alert or incident, performing automated remediation actions like assigning ownership, sending emails, or running a query. They operate after an incident already exists and cannot create a new incident on their own. Execution of a playbook is a downstream response action rather than an upstream incident creation source.

Go deeper

Related to this question