A security team uses Microsoft Sentinel. They create a scheduled analytics rule that queries Azure Activity Logs to detect virtual machines deployed in non-approved regions. The rule generates an incident. The team wants the incident to be automatically assigned to the 'Infrastructure' team and its severity set to 'High' when it is created. Which automation feature should they use?

Create a playbook triggered by alert creation that performs the assignment and severity change

While a playbook can achieve this, it is more complex than necessary. Automation rules are the recommended approach for these built-in actions.

Use an automation rule with trigger 'When incident is updated' and condition on alert type

The trigger 'When incident is updated' would not run on creation; the incident would initially be created without the desired assignment and severity.

Configure the analytics rule directly to set severity and owner

Analytics rules do not have built-in settings to assign incidents to owners or change severity; these are post-creation actions handled by automation rules or playbooks.

What does this AZ-500 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Create an automation rule with trigger 'When incident is created' and actions to assign the incident to an owner and set severity — Sentinel automation rules can be triggered on incident creation (or update) and can execute actions such as changing the incident's severity, assigning it to an owner (e.g., a team), and invoking playbooks. For simple actions like severity change and assignment, an automation rule is the most straightforward and efficient method. A playbook could also be used but would be unnecessarily complex for these actions.

What should I do if I get this AZ-500 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.