SC-200 Manage a security operations environment Practice Question
You are a security operations analyst for a company that uses Microsoft Defender XDR. You need to configure alert notifications so that the security team receives an email whenever a high-severity alert is generated. What should you do?
⚠ Common exam trap
The trap here is assuming that Defender for Endpoint notification settings cover all Defender XDR alerts; they only cover endpoint alerts, while the Microsoft 365 Defender portal settings cover all workloads.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the Microsoft 365 Defender portal, go to Settings > Microsoft 365 Defender > Alert notifications, and create a new notification rule with severity set to High.
Microsoft Defender XDR provides built-in alert notification settings that allow you to define rules based on severity, alert category, and other criteria. Configuring a notification rule with severity High ensures that the security team receives email alerts for high-severity incidents across all Defender workloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
In Microsoft Sentinel, create an automation rule that triggers on high-severity incidents and sends an email using a playbook.
Why it's wrong here
While this could work if Sentinel is ingesting Defender alerts, the requirement is to configure notifications in Defender XDR itself. Using Sentinel adds unnecessary complexity and may not cover alerts that are not forwarded to Sentinel. The native Defender notification settings are more direct.
- ✗
In Microsoft Defender for Endpoint, configure alert notifications for high-severity alerts.
Why it's wrong here
Defender for Endpoint has its own alert notification settings, but they are scoped to endpoint alerts only. The requirement is for all high-severity alerts across Microsoft Defender XDR, which includes multiple workloads. Configuring in Defender for Endpoint alone would miss alerts from other sources like Office 365 or Identity.
- ✗
In Azure Monitor, create an action group that sends emails for high-severity alerts from Microsoft Defender XDR.
Why it's wrong here
Azure Monitor action groups are used for Azure alerts, not for Microsoft Defender XDR alerts. Defender XDR alerts are not natively integrated with Azure Monitor action groups. This approach would not work without additional custom integration.
- ✓
In the Microsoft 365 Defender portal, go to Settings > Microsoft 365 Defender > Alert notifications, and create a new notification rule with severity set to High.
Why this is correct
The Microsoft 365 Defender portal provides alert notification settings where you can define rules based on alert severity. Creating a rule with severity High ensures that only high-severity alerts trigger email notifications to the specified recipients. This is the correct method.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.