Microsoft Security Operations Analyst Associate SC-200 Practice Question

Creating a bookmark from selected hunting results stores the events as an artifact in Microsoft Sentinel. Bookmarks are shown in the investigation graph, can be added to existing incidents, or promoted to new incidents, providing an auditable pivot point for continued analysis. Building an analytics rule schedules the query to run periodically but does not immediately save the current rows for investigation. Watchlists store static reference data such as IP or user lists and are not intended for preserving specific query results. Pinning results to a workbook only creates a visualization and does not integrate the events with investigations or incidents.