SC-200 Certification Practice Question #146

Question

You have a Microsoft Sentinel workspace that uses the Microsoft 365 Defender data connector.

From Microsoft Sentinel, you investigate a Microsoft 365 incident.

You need to update the incident to include an alert generated by Microsoft Defender for Cloud Apps.

What should you use?

Accepted Answer

The documented procedure for adding an alert (including a Defender for Cloud Apps alert) to an incident from within Sentinel is exactly: open the incident's Entities tab, select an entity, and in the entity side panel choose the Timeline card, then click the plus-sign next to an external alert. Option A — though awkwardly phrased ("entity side panel of the Timeline card" rather than the doc's "Timeline card in the entity side panel") — is the only choice naming the entity side panel + Timeline card combination the doc prescribes, and it carries both the Suggested Answer and a 23-vote Most Voted majority. Confidence is held at 80% because the reversed wording and the option C (investigation graph, also a valid relate-alerts method) and option D (Defender portal) dissenting comments create a genuine community split; the MS Learn step list is the tiebreaker favoring A.

More SC-200 practice questions