SC-200 Manage a security operations environment Practice Question
Your team uses Microsoft Sentinel workbooks to visualize security data. You want to allow team members to customize a workbook without affecting the original. What should you do?
⚠ Common exam trap
Candidates often confuse the Microsoft Sentinel Reader role with the ability to customize workbooks, not realizing that Reader only allows viewing, not editing or saving copies, which requires at least Contributor permissions on the workbook resource.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a copy of the workbook and save it as a custom workbook
Creating a copy of the workbook and saving it as a custom workbook allows team members to modify their own version without altering the original. In Microsoft Sentinel, workbooks are based on Azure Monitor Workbooks, and saving a copy creates an independent resource with its own settings and queries. This preserves the original workbook for reference or reuse while enabling customization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Edit the original workbook to add personalization
Why it's wrong here
Editing the original workbook to add personalization directly modifies the shared Azure Workbooks resource that all team members query. When you click Save in a workbook opened from Sentinel, you are updating the same JSON definition, so every user sees your personal changes rather than their own. To maintain individual views, you must create a separate copy of the workbook instead of altering the shared resource.
- ✗
Assign the team the Microsoft Sentinel Reader role
Why it's wrong here
Assigning the Microsoft Sentinel Reader role grants read-only access to Sentinel data and workbooks, but it does not include the Microsoft.Insights/workbooks/write permission required to save workbook changes. With this role, a user can view and query the workbook content, yet any attempt to customize or save a copy fails because the role lacks the necessary write actions on the workbook resource. The correct permission for managing custom workbooks is Workbook Contributor or a custom role that includes workbook write.
- ✓
Create a copy of the workbook and save it as a custom workbook
Why this is correct
Creating a copy of the workbook and saving it as a custom workbook gives each user an independent Azure Workbooks resource that they can personalize without affecting the shared template. In Sentinel, selecting Save As typically prompts you to choose the resource group and name for the new workbook, creating a separate item in Workbooks that only the owner or granted users can edit. This approach satisfies the personalization requirement because modifications are stored in each user's own workbook resource, while the original template remains unchanged.
- ✗
Share the workbook directly with the team
Why it's wrong here
Sharing the workbook directly with the team sends a link to the same underlying workbook resource rather than creating per-user copies. If team members edit that shared workbook, they are overwriting the single Azure Workbooks definition, and those changes become visible to everyone, so the workbook cannot support individual personalization. Sharing may be useful for collaboration, but it fails for this scenario where each user needs their own customized workbook.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 1,303 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.