SC-200 Manage a security operations environment Practice Question
Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to implement a solution that automatically suppresses low-severity incidents from specific IP addresses that are known internal scanners. Which THREE configurations should you make?
⚠ Common exam trap
Test-takers frequently confuse suppression rules in Defender for Cloud (which suppress alerts at the CSPM level) with incident suppression in Sentinel, leading them to select Option D incorrectly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the IP addresses to a watchlist and reference it in analytics rules.
A watchlist in Microsoft Sentinel can store known internal scanner IP addresses, and analytics rules can reference this watchlist to automatically suppress low-severity incidents from those IPs. This allows you to exclude benign scanner activity from generating alerts without modifying the rule logic for other threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add the IP addresses to a watchlist and reference it in analytics rules.
Why this is correct
Correct: Watchlists can be used for filtering.
- ✓
Configure an analytics rule with a suppression condition that includes the IP addresses.
Why this is correct
Correct: Analytics rules can suppress alerts for specific entities.
- ✓
Create an automation rule that closes incidents matching the IP addresses.
Why this is correct
Correct: Automation rules can close incidents based on conditions.
- ✗
Create a suppression rule in Microsoft Defender for Cloud.
Why it's wrong here
Incorrect: Suppression rules in Defender for Cloud only affect its own alerts.
- ✗
Create a playbook that deletes incidents from those IP addresses.
Why it's wrong here
Incorrect: Playbooks cannot delete incidents; they can close them but that's less efficient.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.