SC-200 Manage a security operations environment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable Microsoft Copilot for Security to assist with incident investigations.

  Why this is correct

  Microsoft Copilot for Security, embedded directly in Microsoft Sentinel, uses large language models to generate incident summaries and correlate evidence across alerts, logs, and threat intelligence. This enables analysts to ask natural-language questions about an attack and receive recommended next steps or response actions. By providing context-aware guidance and automating the initial investigative narrative, Copilot reduces the time to understand and act on a security incident.

• ✗

  Use watchlists to track known malicious IP addresses.

  Why it's wrong here

  Watchlists in Sentinel are local data stores—such as IP address lists—that can be joined with Windows Event logs, Cisco ASA logs, or other tables to enrich analytics rules and identify known bad actors. While they improve log detection by adding context, they are not executed as part of an incident response workflow and cannot take automated remediation actions. Tracking known malicious IPs this way helps alert generation, but does not by itself improve response times or orchestrate containment.

• ✗

  Configure workbooks to display real-time incident trends.

  Why it's wrong here

  Workbooks render interactive dashboards and visualizations from Log Analytics workspace data, using KQL queries to display incident counts, severity distribution, or geographic attack trends. They serve as monitoring and reporting tools that provide situational awareness to a SecOps team during an incident. However, they are non-actuating—they neither modify an incident nor trigger a response—so configuring a real-time trend display does not directly impact investigation or remediation speed.

• ✓

  Develop playbooks to automate response actions for common threats.

  Why this is correct

  Playbooks are Azure Logic Apps workflows you deploy in Sentinel to execute a series of automated actions, such as blocking a malicious IP, isolating a user account, or creating a support ticket, in response to a specific alert or incident. They can be triggered manually from an incident or automatically via automation rules, ensuring consistent and fast response to common attack patterns. Automating common threat playbooks significantly reduces manual analyst workload and mean time to respond because response actions are enacted immediately after detection.

• ✓

  Create automation rules to automatically assign and triage incidents based on severity.

  Why this is correct

  Automation rules are declarative conditions that Sentinel evaluates whenever an incident is created or updated; based on rules like severity, tag, or alert product, they can assign ownership, set status, or invoke a playbook. These rules scale triage across large volumes of incidents by ensuring that critical cases are prioritized and previously defined workflow procedures are followed automatically. They streamline incident management but are distinct from playbooks because they act primarily on incident properties rather than performing arbitrary response steps.

Go deeper

Related to this question