An emergency-management agency exports Sentinel incidents to the regional fusion ticket system. What integration is that?
Select an answer to reveal the explanation.
Short Explanation
Emergency ops live in the fusion ticket queue—export Sentinel incidents there so regional partners see the same case. You aren't relaying health signals since that's platform status, not live incidents you'll respond to, and you aren't forwarding workbooks since those are dashboards you'll view, not tickets you'll share. And you aren't just exporting to ticketing archives either — that's storage, while you'll sync live tickets to keep the shared case current.
Full Explanation
Exporting Sentinel incidents to the regional fusion ticket system integrates municipal IR with external fusion ticketing so emergency-management partners share a common case workflow. Fusion centers and partner agencies often live in a regional ITSM or case platform; bi-directional or outbound sync of Sentinel incidents (severity, entities, status, evidence links) keeps civic SOC work visible to partners who may not live in the Azure portal daily. That integration supports mutual aid, after-action reporting, and coordinated response across city and county boundaries.
Relaying Sentinel health with external municipal and regional fusion ticketing systems misstates the object: Sentinel health covers service availability and connector health, not IR incidents with severity, entities, and response workflow that emergency-management partners need in a shared case. Forwarding Sentinel workbooks with external municipal and regional fusion ticketing systems confuses analysis with ticketing: workbooks are interactive dashboards and visualizations for investigation, they don't create or update fusion tickets or sync incident status back to Sentinel. Exporting Sentinel IR with external municipal and regional fusion ticketing archives confuses storage with ticketing: a ticketing archive is long-term retention, it doesn't create or update live fusion tickets, establish the cross-agency case workflow, or write ticket IDs back into Sentinel.
Exam caveat: Integration must handle PII minimization, classification, and retention. Not every field in a Sentinel incident should sync outbound; map allowed attributes and redact citizen data before regional share. Also plan for status sync (close/reopen) to avoid conflicting closure states between systems.
Operational check: Configure Logic Apps/playbooks or ITSM connectors to create/update fusion tickets on Sentinel incident create; verify ticket IDs write back to the Sentinel incident; test with a dummy emergency-management incident; and confirm you're building the direct regional fusion-ticket integration for live incidents, not merely forwarding workbooks for visualization.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.