SC-200 Manage a security operations environment Practice Question
Your organization uses Microsoft Sentinel in a multi-workspace environment with a central SOC. You need to create a single incident view across all workspaces while minimizing latency. What should you deploy?
⚠ Common exam trap
Test-takers frequently confuse Azure Lighthouse (which provides cross-workspace visibility through delegated access) with the native incident synchronization feature, not realizing that Lighthouse alone does not create a unified incident view and requires additional manual configuration to achieve the same low-latency result.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable incident across workspaces in Microsoft Sentinel
Microsoft Sentinel's 'Incident across workspaces' feature (enabled via the 'SecurityIncident' table union) provides a single incident view across multiple workspaces with minimal latency by leveraging built-in cross-workspace incident synchronization. This avoids the overhead of manual queries or external orchestration, ensuring near-real-time incident correlation for a central SOC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use cross-workspace queries in a workbook
Why it's wrong here
Cross-workspace queries in an Azure Workbook can query multiple Log Analytics workspaces via resource-context or workspace-context expressions, but they render tabular query results, not the Sentinel Incident entity. Incidents are stored in the SecurityIncident table and require the Sentinel solution context; a workbook cannot surface the unified incident-management pane, real-time triage workflow, or incident assignment/status updates. It is a visualization tool, not an incident orchestration plane.
- ✓
Enable incident across workspaces in Microsoft Sentinel
Why this is correct
The 'Enable incident across workspaces' feature in Microsoft Sentinel is a built-in capability that creates a central incident view by aggregating incidents from up to 100 Sentinel workspaces, typically spread across regions or tenants, into a single incident list. It leverages Azure Lighthouse for onboarding, but the key is that Sentinel's incident pipeline synchronizes incidents (by incident ARM ID) into a designated central workspace, preserving the original workspace context for each incident. This gives security operations teams a unified queue for detection, investigation, and response without migrating or re-ingesting any data.
- ✗
Merge all workspaces into one Log Analytics workspace
Why it's wrong here
Merging multiple Log Analytics workspaces into one is not a supported operation; you cannot natively 'merge' workspaces, and attempting to do so would require exporting and re-ingesting all historical data, which risks data loss, changes to retention policies, and disruption of analytics rules. Even if you re-ingested data into a single workspace, you would lose the per-workspace data isolation and would have to reconfigure all connectors, Data Collection Rules, and Sentinel analytics rules. This approach is heavy-handed, non-reversible, and unnecessary because Sentinel already supports a centralized incident view without physical data consolidation.
- ✗
Set up Azure Lighthouse and connect workspaces
Why it's wrong here
Azure Lighthouse alone provides cross-tenant management capabilities—such as delegated resource groups and unified management operations—but it does not, by itself, aggregate or display Sentinel incidents in a single incident queue. While Lighthouse is a prerequisite for onboarding multiple workspaces to Sentinel's cross-workspace incident view, merely setting it up and 'connecting' workspaces without enabling the incident aggregation feature leaves incidents scattered across each workspace's own Sentinel blade. The missing piece is the explicit 'Enable incident across workspaces' setting that tells Sentinel to synchronize incidents to a central workspace; Lighthouse is necessary but not sufficient.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.