SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Modify the analytics rule to send an email when an alert fires.

  Why it's wrong here

  Modifying the analytics rule to send an email when an alert fires is not supported natively. Analytics rules are configured to generate alerts from data and can optionally trigger a playbook via alert automation, but they do not have a direct 'send email' action. While alert automation can run a logic app, that requires building and associating a playbook and fires on alert generation rather than incident scoring. Therefore, using an automation rule at incident creation is the more direct and controlled approach.

• ✗

  Create a playbook that sends an email when an incident is created.

  Why it's wrong here

  Creating a standalone playbook with an email step is insufficient because playbooks do not execute by themselves; they must be triggered by an automation rule or another connector. If you build a playbook to send an email when an incident is created, you still need to associate that playbook with an automation rule that has a 'Run Playbook' action. Moreover, for simple email notifications, a playbook introduces unnecessary overhead (e.g., Logic Apps resource, managed identity, and runtime costs) compared to the built-in 'Send Email' action in an automation rule. Thus, the playbook is possible but not the simplest or first-class solution.

• ✓

  Configure an automation rule with an action to send an email notification.

  Why this is correct

  Configuring an automation rule with an action to send an email notification is the correct approach in Microsoft Sentinel for alerting on incident creation. Automation rules are specifically designed to handle incident lifecycle events (created, updated, etc.) and can perform one or more actions immediately, without needing an external logic app. The 'Send Email' action directly sends an email to a specified recipient, using configured SMTP or Microsoft 365 settings, and can include incident details in the body. This method is natively supported, requires minimal setup, and ensures timely notification whenever an incident meets the condition (e.g., high severity).

• ✗

  Use advanced hunting to query high severity incidents and send email.

  Why it's wrong here

  Using advanced hunting to query high-severity incidents and send email is not an appropriate automated notification mechanism because advanced hunting is a manual, interactive KQL-based query console for threat investigators. It offers a 'Query' action that can produce results, but there is no native functionality to execute queries on a schedule or trigger email automatically. To achieve automation, you would have to create a scheduled analytics rule or use Azure Logic Apps to periodically run the query and send email, which is effectively recreating the functionality already provided by automation rules. Hence, this method is both impractical and out-of-scope for operational incident response notifications.

Go deeper

Related to this question