AZ-500 Manage identity and access Practice Question
A security team uses Microsoft Sentinel. They want to automatically assign a severity level and an owner to every incident that is created from a specific analytics rule. The owner should be a specific security operations group. Which Microsoft Sentinel feature should they configure to achieve this automation?
⚠ Common exam trap
Many candidates confuse automation rules with playbooks, assuming that any automation requires a Logic Apps playbook, but automation rules are the correct, lightweight feature for simple field assignments like severity and owner.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an automation rule that triggers when an incident is created and sets the severity and owner fields.
Automation rules in Microsoft Sentinel allow you to centrally manage incident handling by triggering actions when incidents are created or updated. By configuring an automation rule that triggers on incident creation from the specific analytics rule, you can automatically set the severity and assign the incident to a security operations group (via an Azure AD group or user) without custom scripting or manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the analytics rule to include a custom script that runs upon alert generation.
Why it's wrong here
Analytics rules are KQL-based detection definitions; they cannot embed custom scripts to execute directly upon alert generation. The only way to automate post-detection actions is through automation rules or playbooks configured to run when an alert or incident is created. Adding a custom script to the analytics rule would neither be supported by the rule schema nor allow modification of incident fields during incident creation. Therefore it is not a viable method.
- ✓
Create an automation rule that triggers when an incident is created and sets the severity and owner fields.
Why this is correct
Automation rules in Sentinel are purpose-built to perform immediate actions, such as changing severity or assigning an owner, when an incident is created (e.g., when triggered by a specific analytics rule's incident generation). They support conditions and multiple actions and can be prioritized to ensure the desired incident properties are set consistently. This makes automation rules the correct way to enforce classification and ownership at the point of incident creation, without custom code or external integration.
- ✗
Use a Logic Apps playbook connected to the analytics rule's alert generation trigger.
Why it's wrong here
Logic Apps playbooks triggered by an analytics rule's alert generation operate on the generated *alert*, not the *incident* itself. Therefore, they cannot directly assign incident severity and owner during the incident creation process, which is required here. This scenario needs to modify incident properties at the point of creation. Playbooks are tempting because they are powerful for general automation, such as enriching alerts, orchestrating complex response actions *after* incident creation, or integrating with external systems like Microsoft Entra ID.
- ✗
Configure a workbook to filter and manually assign incidents.
Why it's wrong here
Workbooks are read-only Azure Monitor-based dashboards that visualize Sentinel data through queries and filtering; they have no capability to mutate incident properties such as severity or owner. Even if a security analyst manually selects incidents in a workbook, there is no action model or API exposed to write those assignments back to Sentinel incidents. Using a workbook for incident management would be limited to reporting and requires separate manual updates in the Incidents blade, so it does not meet the automation requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.