SC-200 Respond to security incidents Practice Question
Your organization uses Microsoft Sentinel. You are investigating an incident and need to gather additional context about a suspicious IP address. Which TWO Microsoft Sentinel features can you use to enrich the investigation?
⚠ Common exam trap
Watch out — candidates often confuse UEBA (Option E) with entity behavior analytics (Option D), but UEBA is a broader analytics framework that does not directly enrich a specific IP address with external threat context, whereas entity behavior analytics is the correct feature for enriching investigation by providing entity-specific behavioral insights.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Threat intelligence
Threat intelligence is correct because it allows you to cross-reference the suspicious IP address against known threat intelligence feeds (e.g., Tor exit nodes, known C2 servers) directly within Microsoft Sentinel. This enriches the investigation by providing context such as reputation scores, associated malware families, and geographic origin, helping you assess the IP's maliciousness.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Threat intelligence
Why this is correct
Threat intelligence can indicate if the IP is known malicious.
- ✗
Watchlist
Why it's wrong here
Watchlists store data for correlation, not enrichment.
- ✗
Hunting
Why it's wrong here
Hunting is for proactive searches, not enrichment.
- ✓
Entity behavior analytics
Why this is correct
Entity behavior analytics provides historical activity and anomalies.
- ✗
User and Entity Behavior Analytics (UEBA)
Why it's wrong here
UEBA is a broader feature; entity behavior analytics is the specific tool.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.