SC-200 Certification Practice Question #111

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are configuring Azure Sentinel.
You need to create an incident in Azure Sentinel when a sign-in to an Azure virtual machine from a malicious IP address is detected.
Solution: You create a Microsoft incident creation rule for a data connector.
Does this meet the goal?

Accepted Answer

A "Microsoft incident creation rule" (the *Microsoft security* analytics-rule type) exists only to automatically convert alerts that a connected Microsoft security product — Defender for Cloud, Defender for Identity, Defender for Endpoint, etc. — has *already* generated into Microsoft Sentinel incidents. It contains no query logic, so on its own it cannot detect a sign-in to a VM from a malicious IP address; that detection needs a scheduled/custom analytics rule running KQL over the relevant sign-in/security-event table. MS Learn confirms incident-creation rules act on alerts from connected solutions rather than performing detection. The Suggested Answer (B), the Most Voted community answer (B, 12 votes), and the two highest-voted reasoned comments (eddz25, CollabGuy) all agree on **No**. Confidence is 84% — strong agreement grounded in MS Learn, with the answer docked slightly for the genuine minority of A votes (notably Metasploit's 👍 7).

More SC-200 practice questions