SC-200 Manage a security operations environment Practice Question
Your organization uses Microsoft Sentinel. You need to configure a playbook that automatically responds to incidents by creating a support ticket in ServiceNow. Which connector should you use?
⚠ Common exam trap
Many candidates choose the HTTP connector thinking it is more flexible, but the ServiceNow connector is the purpose-built, supported solution that handles authentication and field mapping natively, making it the correct choice for this specific integration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ServiceNow connector
The ServiceNow connector is the correct choice because it provides a direct, pre-built integration between Microsoft Sentinel and ServiceNow, enabling automated creation of incidents or tickets in ServiceNow when a Sentinel incident is triggered. This connector uses the ServiceNow REST API to map Sentinel fields to ServiceNow ticket fields, eliminating the need for custom HTTP calls or additional middleware.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HTTP connector
Why it's wrong here
The HTTP connector in Microsoft Sentinel is a generic data connector that requires you to manually configure API calls, handle authentication (such as OAuth or API keys), and parse the returned payloads before they can be ingested into Log Analytics. It lacks built-in ticketing workflows, so creating ServiceNow tickets would demand custom Logic Apps or Azure Functions, making it a poor fit for this scenario. The connector is intended for custom data sources, not for turnkey integration with a ticketing system.
- ✓
ServiceNow connector
Why this is correct
The ServiceNow connector in Microsoft Sentinel provides a native, out-of-the-box integration that allows security operations teams to automatically create, update, and close incidents as ServiceNow tickets. It leverages the ServiceNow API with prebuilt authentication handling and a data collection rule, eliminating the need for custom code or manual API calls. This directly meets the requirement to configure the environment for ticket creation, making it the correct choice.
- ✗
Azure Monitor connector
Why it's wrong here
The Azure Monitor connector is designed to bring in diagnostic and activity data from Azure resources into the Log Analytics workspace, and it is not a ticketing integration. It queries and ingests monitoring data, but it has no native capability to create ServiceNow tickets. Using it would require pairing with custom Logic Apps or the HTTP connector, which goes beyond the straightforward configuration needed, so it is incorrect for this requirement.
- ✗
Office 365 Outlook connector
Why it's wrong here
The Office 365 Outlook connector is built for email-centric actions such as sending messages, managing calendars, and scanning inboxes, typically used in Logic Apps or Power Automate workflows. In the context of Sentinel, it does not provide a native ticketing bridge to ServiceNow; you would need to design a custom workflow that reads incident data and then sends email to create tickets. This is an indirect and less reliable method compared to the direct ServiceNow connector, making it a wrong option for a native integration.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.