SC-200 Certification Practice Question #255

Question

You have an Azure subscription that uses Microsoft Sentinel.

You need to create a custom workbook that will calculate the average time it takes to close security incidents. The solution must minimize administrative effort.

Which built-in Microsoft Sentinel workbook template should you select?

Accepted Answer

The task is to surface the average time to close security incidents with minimal administrative effort, which means picking the built-in template that already computes that metric rather than building a custom query. MS Learn documents the **Security operations efficiency** workbook as the out-of-the-box template whose metrics explicitly include "Mean time to closure" and "Time to closure percentiles," so it satisfies the requirement with zero custom work. The Workspace Usage Report covers ingestion/cost, Investigation Insights aids per-incident drill-down, and Incident Overview summarizes a single incident — none expose an average close-time KPI. Suggested Answer (A), Most Voted (A, 5 votes), the 3-👍 confirmation, and MS Learn all agree, giving high confidence.

More SC-200 practice questions