AZ-305 Practice Question: Design identity, governance, and monitoring solutions
Your company uses Microsoft Sentinel for security monitoring. You need to design a solution that automatically responds to incidents involving high-severity alerts. The response should include creating an incident in Microsoft Teams and sending an email to the security team. What should you use?
⚠ Common exam trap
Many candidates confuse Azure Monitor action groups (which can send emails/SMS for metric alerts) with Sentinel's incident-specific automation, overlooking that Sentinel requires its own automation rules and playbooks to orchestrate security response workflows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Sentinel automation rules and playbooks
Microsoft Sentinel automation rules and playbooks (built on Azure Logic Apps) are specifically designed to orchestrate automated responses to security incidents. When a high-severity alert triggers an incident, an automation rule can invoke a playbook that creates a Microsoft Teams message and sends an email via connectors like Office 365 Outlook, meeting the exact requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Sentinel automation rules and playbooks
Why this is correct
Automation rules in Microsoft Sentinel are the native incident-response engine; they evaluate incidents as they are created or updated and can immediately trigger a playbook, which is an Azure Logic Apps workflow. A playbook can call the Teams connector to post a message to a security channel, send email through Outlook, open a ticket, or run containment actions, making it the only option here that directly addresses the requirement to create Teams messages and send emails during incident response.
- ✗
Azure Policy with remediation tasks
Why it's wrong here
Azure Policy is a governance and compliance service that continuously evaluates Azure resource configuration against policies and can remediate non-compliant resources with managed identity tasks, such as deploying a required setting. It has no awareness of Sentinel incidents and cannot react to security detections in near real time, so it cannot create a Teams message or send an email when an incident is generated. Its remediation tasks are resource-centric, not incident-centric.
- ✗
Azure Monitor alert rules with action groups
Why it's wrong here
Azure Monitor alert rules evaluate platform metrics and log queries to produce alerts, and their action groups can send emails, SMS, push notifications, or webhooks to notify operators, but these alerts are independent of Sentinel incident lifecycle and do not contain Sentinel incident metadata. Action groups are generic notification channels; they lack the Sentinel-aware trigger context and Logic Apps integration that automation rules provide, so they cannot automatically create or update a Sentinel incident or trigger a workflow specifically designed for incident response.
- ✗
Microsoft Defender for Cloud security alerts
Why it's wrong here
Microsoft Defender for Cloud generates security alerts and recommendations from its workload protection plans, and these alerts can be streamed into Sentinel as data, but the alerts themselves do not include an event-driven response workflow. Defender for Cloud does not provide the native Teams or Outlook action connectors that Sentinel playbooks use, and its alert generation is a detection source rather than an orchestration layer. Therefore, while it may identify a threat, it cannot by itself post to Teams or send the response email.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.