SC-200 Certification Practice Question #211

Question

You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1.

You need to ensure that the incidents in WS1 include a list of actions that must be performed. The solution must meet the following requirements:

•	Ensure that you can build a tailored list of actions for each type of incident.
•	Minimize administrative effort.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Row 1 is unambiguous and unanimous across MS Learn and the discussion (renrenren 19 👍, akamex, g_man_rap): incident **Tasks** are the feature designed to document a tailored, reusable checklist of actions analysts must perform per incident type — exactly the requirement, with minimal admin effort because tasks are scoped per analytics rule. Row 2 is the contested cell. The mechanism that *builds* the task checklist is the **Add task** action inside an **automation rule**, and in the analytics rule wizard automation rules are viewed/created on the **Automated response** tab. The **Incident settings** tab (g_man_rap's pick, 5 👍) governs only incident creation and alert grouping and contains no task functionality, so despite its higher vote count it is technically wrong per MS Learn. I therefore side with smanzana/Tuitor01 (Automated response) and lower confidence to 80% to reflect the genuine community split and the absence of an official suggested answer for this HOTSPOT.

More SC-200 practice questions