SC-200 Manage a security operations environment Practice Question
Your organization wants to use Microsoft Copilot for Security to generate incident summaries. What is the minimum license required?
⚠ Common exam trap
Many exam-takers assume Copilot for Security is included with high-tier licenses like Microsoft 365 E5 or Microsoft Sentinel, but Microsoft explicitly requires a separate Copilot for Security license (standalone or add-on) to use its AI capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Copilot for Security standalone or add-on
Microsoft Copilot for Security is a standalone product that can be licensed independently or as an add-on to existing security subscriptions. It is not included in any Microsoft 365 or Defender plan by default; therefore, the minimum license required is either the standalone Copilot for Security SKU or the add-on license. This ensures the organization has the necessary entitlements to generate incident summaries using Copilot for Security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft 365 E5
Why it's wrong here
Microsoft 365 E5 is an enterprise productivity and security suite that bundles Defender for Office 365, Defender for Endpoint, and other security workloads, but Copilot for Security is not part of the E5 entitlement. Using Copilot in the Microsoft Defender portal or Sentinel requires a separate Copilot license, either purchased as a standalone capacity-based SKU or via an E5 add-on, so E5 alone is insufficient.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native SIEM and SOAR service licensed through Azure, often with pay-as-you-go analytics, and being an active Sentinel workspace only gives you access to that telemetry and investigation tooling. It does not grant rights to Copilot for Security; Copilot is an AI service that can query Sentinel data, but its licensing is distinct, based on Security Compute Units, not on Sentinel's workspace quotas or pricing tier.
- ✗
Microsoft Defender for Office 365 P2
Why it's wrong here
Microsoft Defender for Office 365 P2 is an email and collaboration security plan that covers advanced threat protection for mailboxes and Teams, and it is commonly included in E5, yet it carries no entitlement to Copilot for Security. The P2 license governs message filtering, attack simulation, and post-breach capabilities; AI assistance in Defender portals requires the separate Copilot for Security license or an applicable add-on, therefore P2 alone does not satisfy the requirement.
- ✓
Microsoft Copilot for Security standalone or add-on
Why this is correct
Microsoft Copilot for Security is the only licensing option that actually grants access to the embedded AI features in Microsoft security products, whether you purchase it as a standalone capacity-based SKU with Security Compute Units or as an add-on to an eligible plan such as Microsoft 365 E5. This license provides the entitlement for Copilot experiences across Defender, Sentinel, and Entra, which is why it is the required license for the organization's goal.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.