SC-200 Certification Practice Question #139

Question

You have a Microsoft Sentinel workspace that contains an Azure AD data connector.

You need to associate a bookmark with an Azure AD-related incident.

What should you do? To answer, drag the appropriate blades to the correct tasks. Each blade may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Accepted Answer

MS Learn's bookmark procedure shows the **Add bookmark** action physically appears in the **Logs** pane after running a hunting query, so a bookmark is *created* using the Logs blade. Adding that bookmark to a new or existing incident is performed from the **Bookmarks** tab on the **Hunting** page via **Incident actions**, so the association is done using the Hunting blade. This matches the highest-voted comment (danb67, 21 👍, "Logs and Hunting") and danituga (4 👍). The competing "Hunting/Hunting" and "Hunting/Incidents" readings have merit because the bookmark workflow is reached via Hunting, but given the three literal blade choices the Logs-then-Hunting split is the most defensible per the docs. Confidence is held at 80% because the community is genuinely split and no official Suggested Answer is recorded in the file.

More SC-200 practice questions