SC-200 Certification Practice Question #149

Question

You have 50 Microsoft Sentinel workspaces.

You need to view all the incidents from all the workspaces on a single page in the Azure portal. The solution must minimize administrative effort.

Which page should you use in the Azure portal?

Accepted Answer

MS Learn's "Work with incidents in many workspaces at once" describes Multiple Workspace View: from the Sentinel landing page you check the workspaces and click View incidents, which opens a page that "looks and functions in most ways like the regular Incidents page" and shows incidents from all selected workspaces in one unified list. The question asks specifically which page lets you VIEW all incidents on a single page with minimal effort — that destination page is Microsoft Sentinel - Incidents (option A), the official Suggested Answer and the dominant community vote (21). Confidence is held at 80% rather than higher because a strong minority (NeoTactics, 👍 10) reasonably reads option C as the entry point where workspace selection happens; however C alone doesn't display the incidents and requires the Incidents view to show them, so A remains the best-supported answer.

More SC-200 practice questions