SC-200 Manage a security operations environment Practice Question
Your organization has deployed Microsoft Sentinel and Microsoft Defender XDR. You need to ensure that all Defender XDR incidents are automatically synchronized into Microsoft Sentinel for a single pane of glass. What should you configure?
⚠ Common exam trap
Test-takers frequently confuse alert-based connectors (like the Microsoft Defender for Endpoint connector) with the incident-level Microsoft Defender XDR connector, or they assume that automation rules or webhooks are the correct method for incident synchronization, when the native connector is the only supported and recommended approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the Microsoft Sentinel data connector for Microsoft Defender XDR
The Microsoft Sentinel data connector for Microsoft Defender XDR is the native integration that automatically synchronizes all Defender XDR incidents into Sentinel. This connector ingests incidents, alerts, and evidence from Defender XDR into the Sentinel workspace, enabling a single pane of glass without requiring custom scripting or manual workflows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable the Microsoft Sentinel data connector for Microsoft Defender XDR
Why this is correct
The Microsoft Sentinel data connector for Microsoft Defender XDR is the native, supported integration that continuously streams incidents and alerts from Defender XDR into Sentinel using the Microsoft Graph API. Once enabled, incident properties, status, and severity are automatically synchronized bi-directionally, enabling SOC analysts to manage the full incident lifecycle from a single pane. This requires no custom coding, uses built-in authentication, and provides near real-time ingestion, making it the only correct solution for this scenario.
- ✗
Use Microsoft Graph API to sync incidents daily
Why it's wrong here
Writing a custom script to sync Defender XDR incidents via Microsoft Graph API on a daily schedule introduces significant latency and operational overhead, as incidents can change many times within a day and would never appear timely in Sentinel. You would need to handle OAuth authentication, pagination, rate limiting, and manual schema mapping into Sentinel's custom logs or APIs, and the one-way import would not update Sentinel incidents when Defender XDR incidents are later resolved. This approach also lacks the built-in incident correlation and UI support provided by the official data connector.
- ✗
Create an automation rule in Microsoft Sentinel to create incidents from Defender XDR alerts
Why it's wrong here
Automation rules in Microsoft Sentinel are designed to respond to incidents and alerts that already exist in Sentinel, typically triggered by analytics rules; they cannot reach out to external sources like Defender XDR alerts to create new incidents on demand. Their playbooks and triggers run after an alert or incident is created, not before, so they cannot serve as an ingestion mechanism for third-party alert data. Even after the Microsoft Defender XDR connector is enabled, automation rules only enrich or respond to ingested incidents, never generate them from external alerts.
- ✗
Configure Microsoft Defender XDR to forward incidents to Sentinel using a webhook
Why it's wrong here
Microsoft Defender XDR does not expose a native webhook feature to push incidents to an external security information and event management (SIEM) system, so this option is not directly available in the portal. While you could construct a manual flow using Logic Apps or Power Automate to trigger on Defender XDR API events and call a Sentinel webhook, that custom solution would require building an HTTPS endpoint, handling authentication and retry logic, and would still not provide the same real-time, bidirectional incident synchronization as the data connector. Therefore, configuring a webhook is neither supported natively nor a practical replacement for the official connector.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization has deployed Microsoft Defender XDR and Microsoft Sentinel in a hybrid environment. You need to ensure that incidents from Microsoft Defender for Endpoint are synchronized to Microsoft Sentinel with full alert details. You have already connected the Microsoft Defender XDR connector. What additional step must you take?
hard- ✓ A.In the Microsoft Defender XDR connector, enable 'Microsoft 365 Defender incident creation'.
- B.Enable the Microsoft Defender for Endpoint API connector in Microsoft Sentinel.
- C.Configure a bi-directional sync between Microsoft Sentinel and Microsoft Defender XDR.
- D.No additional steps are required; the connector automatically syncs all incident details.
Why A: After connecting the Microsoft Defender XDR connector, you need to enable 'Microsoft 365 Defender incident creation' within the connector settings to ensure that incidents from Microsoft Defender for Endpoint are synchronized to Microsoft Sentinel with full alert details. Option B is incorrect because the Microsoft Defender for Endpoint API connector is not required; the XDR connector handles incident streaming. Option C is incorrect because bi-directional sync is not supported and not needed. Option D is incorrect because the connector does not automatically sync full alert details without enabling incident creation.
Variation 2. Your organization has recently deployed Microsoft Sentinel and Microsoft Defender XDR. You are tasked with configuring the environment to ensure that incidents created by Microsoft Defender for Cloud Apps are automatically synchronized to Microsoft Sentinel. The security operations team wants to manage all incidents from within Sentinel. You have already connected the Microsoft Defender XDR connector to Sentinel. However, you notice that incidents from Defender for Cloud Apps are not appearing in Sentinel. You verify that the Defender for Cloud Apps connector is not listed in the data connectors blade. What should you do to resolve this issue?
easy- A.Enable the Microsoft Sentinel integration in the Defender for Cloud Apps portal.
- B.Configure a data collection rule in Microsoft Purview to forward alerts to Sentinel.
- C.Install the Microsoft Defender for Cloud Apps connector from Sentinel data connectors.
- ✓ D.Ensure the Microsoft Defender XDR connector is configured to include Defender for Cloud Apps incidents.
Why D: When Microsoft Defender XDR connector is enabled in Sentinel, it can ingest incidents from all Microsoft Defender products, including Defender for Cloud Apps, provided the connector's configuration includes the option to synchronize those incidents. Since the Defender for Cloud Apps connector is not listed separately, the correct approach is to verify and adjust the Microsoft Defender XDR connector's settings to include Defender for Cloud Apps incidents. Option D directly addresses this by ensuring the existing connector is configured to forward those incidents.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.