SC-200 Certification Practice Question #267

Question

Which rule setting should you configure to meet the Azure Sentinel requirements?

Accepted Answer

The Azure Sentinel requirement is to group related alerts into a single incident based on shared entities. Per MS Learn, entity mapping is configured on the **Set rule logic** tab, and the alert-grouping setting "Group alerts into a single incident if the selected entities and details match" can only reference entities that were mapped there — exactly the behavior Lion007 (11 👍) describes (an empty drop-down without mapping). Suggested Answer, the unanimous Most Voted (15), and several high-vote comments all select C. The only dissent (A, 1 👍) conflates suppression with grouping, and the "out of date" notes still conclude C is the best of the four. Confidence is 86% (not higher) because newer Sentinel builds allow some grouping without explicit entity mapping, but C remains the clearly correct choice for the requirement.

More SC-200 practice questions