AZ-500 Manage identity and access Practice Question
A security analyst uses Microsoft Sentinel. They have created a playbook that tags Azure VMs as 'isolated' when a high-severity malware alert is triggered. They want this playbook to run automatically whenever a related alert is generated. Which feature should they configure?
⚠ Common exam trap
Many candidates confuse automation rules with analytics rules, mistakenly thinking that scheduled analytics rules can directly trigger playbooks, but analytics rules only generate alerts and do not natively invoke automated responses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automation rule.
Automation rules in Microsoft Sentinel allow you to define triggers that automatically run playbooks when specific alerts or incidents are created. In this scenario, the playbook tags Azure VMs as 'isolated' upon a high-severity malware alert, and an automation rule can be configured to run that playbook automatically whenever such an alert is generated, without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Automation rule.
Why this is correct
Automation rules in Microsoft Sentinel enable automated incident management by executing playbooks directly in response to incident creation or update events. You can define conditions based on alert properties and specify actions like running a playbook, changing status, or assigning ownership. This is the correct mechanism to run a playbook automatically without manual intervention.
- ✗
Scheduled analytics rule.
Why it's wrong here
A scheduled analytics rule is a query-based detection that runs at defined intervals and creates incidents when results match the query. It does not contain any capability to execute playbooks; instead, it only generates the incident record. To trigger a playbook on those incidents, you must attach an automation rule that responds to the incident creation event.
- ✗
Incident creation rule.
Why it's wrong here
There is no dedicated 'incident creation rule' object in Microsoft Sentinel's architecture. Incidents are produced by analytics rules, such as scheduled or Microsoft security rules, or imported from external sources, but the platform does not expose a separate rule type solely for incident creation. Automation rules were introduced specifically to handle post-creation actions like invoking playbooks.
- ✗
Workbook.
Why it's wrong here
Workbooks in Sentinel are interactive dashboards that visualize data through queries and metrics, providing operational insight and reporting. They are purely for display and analysis; they do not contain logic to execute playbooks or perform automated responses. Thus, a workbook cannot be used to run a playbook automatically.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.