SC-200 Manage a security operations environment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a playbook in Microsoft Sentinel that sends an email when an incident is created.

  Why it's wrong here

  A Microsoft Sentinel playbook uses Azure Logic Apps to automate incident response, and it can indeed send emails via an Office 365 Outlook connector. However, a Sentinel playbook is triggered by Sentinel incidents, not by native Microsoft Defender XDR incidents unless you have enabled the Defender XDR data connector and created a corresponding automation rule. Since the scenario explicitly states you are managing a Defender XDR environment, using Sentinel introduces an unnecessary dependency and does not leverage the built-in email notification rule available in the Microsoft 365 Defender portal. Moreover, this approach would not meet the requirement to directly notify on Defender XDR incident creation.

• ✗

  Configure an automation rule in Microsoft Sentinel to send email notifications.

  Why it's wrong here

  Automation rules in Microsoft Sentinel are designed to manage the incident lifecycle inside the Sentinel workspace, such as changing status, assigning ownership, or triggering playbooks. They do not natively run against Microsoft Defender XDR incidents; Defender XDR incidents must first be streamed into Sentinel via the Microsoft 365 Defender connector, and even then the automation rule executes on the Sentinel representation of the incident, not the original Defender incident. The native, simpler solution is to create an email notification rule directly in Microsoft Defender XDR, which does not require Sentinel to be deployed or configured.

• ✓

  Create an email notification rule in Microsoft Defender XDR with conditions for severity and status set to 'Active'.

  Why this is correct

  Email notification rules in Microsoft Defender XDR are the native mechanism for sending email alerts when incidents meet specific criteria, such as severity (high, medium) and status (New, Active, Resolved). To receive notifications for open investigations, you would set the status condition to 'Active' and select the desired severity levels, then specify the recipient address and notification frequency. This rule is managed directly in Microsoft 365 Defender portal under Settings > Microsoft 365 Defender > Email notifications > Incidents, making it the intended feature for this scenario. It operates independently of Microsoft Sentinel and covers the full scope of Defender XDR incidents.

• ✗

  Configure alert service settings in the Microsoft 365 Defender portal to send emails for high and medium severity alerts.

  Why it's wrong here

  The Microsoft 365 Defender portal does include alert service settings for email notifications, but those are typically for service-specific alerts (for example, antivirus or endpoint alerts) rather than unified incident notifications. Selecting 'alert service settings' may lead you to configure notifications at the alert level instead of the incident level, which this scenario requires. The correct feature in Defender XDR is specifically called 'Email notification rules', and it allows you to filter by incident severity and incident status, which the alert service settings do not provide in the same manner. Thus, while this option seems similar, it does not use the precise native feature designed for incident email notifications.

Go deeper

Related to this question