SC-200 Practice Question 3678
Exam: SC-200
Domain: Manage a security operations environment
Difficulty: easy
You are configuring the Microsoft Defender XDR connector in Microsoft Sentinel. What feature should you enable in the connector configuration to avoid duplicate alerts and work tickets in your SOC workflow?
Answer Options
A
Bidirectional Incident Synchronization / Incident Creation Rules
B
Disabling all Sentinel analytics rules tenant-wide
C
Deleting the Log Analytics workspace weekly
D
Enabling continuous manual CSV export
Correct Answer
A: Bidirectional Incident Synchronization / Incident Creation Rules
Explanation
Enabling Microsoft Sentinel Incident Creation Rules or Incident Synchronization ensures that Defender XDR incidents and alerts sync bidirectionally without creating duplicate independent incidents.