SC-200 Manage a security operations environment Practice Question
Your security team uses Microsoft Defender XDR (formerly Microsoft 365 Defender) to investigate incidents. You notice that some alerts from Microsoft Defender for Endpoint are not being automatically correlated into incidents as expected. You have confirmed that the relevant alert sources are enabled in the Microsoft Defender XDR portal. What is the most likely cause?
⚠ Common exam trap
Candidates often assume enabling an alert source in the Microsoft Defender XDR portal automatically enables incident correlation for that source, but in reality, correlation rules must be explicitly enabled separately for each source.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incident correlation rules are not enabled for the relevant alert sources.
Microsoft Defender XDR uses built-in correlation logic to automatically group related alerts from different sources (e.g., Defender for Endpoint, Defender for Office 365) into incidents. If alerts from a specific source, such as Defender for Endpoint, are not being correlated, the most likely cause is that the incident correlation rules for that source are not enabled in the Microsoft Defender XDR portal. Enabling the alert source alone is insufficient; the correlation engine must be explicitly activated for each source to aggregate alerts into incidents.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Alert tuning rules are causing the alerts to be excluded.
Why it's wrong here
Tuning rules reduce alert volume but do not prevent incident creation from remaining alerts.
- ✓
Incident correlation rules are not enabled for the relevant alert sources.
Why this is correct
Correlation rules must be enabled to automatically create incidents from alerts.
- ✗
Automation rules in Microsoft Sentinel are deleting the alerts.
Why it's wrong here
Sentinel automation rules apply to Sentinel alerts, not Defender XDR incidents.
- ✗
Alert suppression rules are blocking the alerts.
Why it's wrong here
Suppression rules hide alerts but do not prevent incident creation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Defender XDR. You need to ensure that alerts from Microsoft Defender for Identity are automatically correlated with alerts from Microsoft Defender for Endpoint in the unified incidents queue. What should you verify?
medium- A.Microsoft Defender for Office 365 is enabled
- ✓ B.Microsoft Defender XDR incident correlation is enabled
- C.Microsoft Sentinel is connected to Microsoft Defender XDR
- D.Custom detection rules are created in Microsoft 365 Defender
Why B: Microsoft Defender XDR incident correlation is the feature that automatically aggregates alerts from different Microsoft Defender workloads—including Defender for Identity and Defender for Endpoint—into a single unified incident. When this setting is enabled, the correlation engine analyzes alert telemetry and entities (such as user accounts, devices, and IP addresses) to merge related alerts, reducing alert fatigue and providing a consolidated view. Without this setting enabled, alerts from different workloads remain isolated and are not automatically correlated in the unified incidents queue.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.