Microsoft Security Operations Analyst Associate SC-200 Practice Question

The Fusion analytics rule type uses built-in machine-learning models to correlate alerts from multiple Microsoft security products into a single high-fidelity incident that represents a multistage attack. For Fusion to function, at least one of its supported Microsoft security data connectors (for example, Microsoft Defender for Endpoint or Azure AD Identity Protection) must already be enabled and actively streaming alerts into the workspace. Other rule types such as scheduled rules, Microsoft incident creation rules, or machine-learning behavior analytics rules either do not perform cross-product correlation automatically or require different prerequisites (for example, UEBA enablement), so they would not meet the requirement in this scenario.