hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: A security analyst is configuring a Microsoft…
A security analyst is configuring a Microsoft Sentinel playbook to automatically respond to phishing incidents. The playbook should only run when an incident of severity 'High' is created and the incident is not already assigned to a user. Which automation rule condition and trigger configuration should the analyst use?
⚠ Common exam trap
It's easy for candidates to think the playbook itself should handle all logic (like checking assignment) via conditions inside the Logic App, but the automation rule's condition engine is designed for this filtering and is more efficient, leading them to choose Option D instead of A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an automation rule with trigger 'When incident is created', conditions for severity equals High and 'Assigned to' is empty, and action to run the playbook.
The automation rule trigger 'When incident is created' ensures the playbook runs immediately upon incident creation, and the conditions for severity equals 'High' and 'Assigned to' is empty filter incidents precisely as required. This configuration offloads the filtering to Sentinel's automation rule engine, which is more efficient and reliable than handling it inside the playbook logic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure an automation rule with trigger 'When incident is created', conditions for severity equals High and 'Assigned to' is empty, and action to run the playbook.
Why this is correct
Configuring an automation rule with trigger 'When incident is created' and conditions for severity equals High and 'Assigned to' is empty ensures the playbook runs only for newly created High-severity incidents that are unassigned. This pre-filtering eliminates unnecessary playbook executions and allows the playbook to focus solely on the response actions, such as assigning an owner or initiating an investigation. Because the trigger fires on incident creation, the conditions are evaluated at the moment the incident is generated, which is the correct pattern for this scenario.
- ✗
Configure a playbook trigger 'When an incident is updated' and add a condition in the playbook logic app to check severity and assignment.
Why it's wrong here
Choosing a playbook trigger of 'When an incident is updated' is problematic because this trigger fires on every incident modification, including comments, status changes, or other updates, not just when the incident is first created. The Logic App would need its own condition checks for severity and assignment, but an automation rule with a creation trigger is the recommended and simpler approach. Even if the Logic App filters correctly, the rule would still execute the playbook on every relevant update, potentially causing multiple, redundant runs for the same incident.
- ✗
Schedule the playbook to run every 5 minutes and query for new incidents with required properties.
Why it's wrong here
Scheduling the playbook to run every 5 minutes and querying for new incidents is not event-driven, introducing latency of up to five minutes between incident creation and response. This polling approach also requires extra permissions to query Sentinel incidents repeatedly and can miss incidents if the query window overlaps or if the API has failures. Automation rules provide near-instant, reliable triggering and are the standard way to invoke playbooks based on incident properties.
- ✗
Configure an automation rule with trigger 'When incident is created' and only condition for severity equals High; the playbook will handle unassigned checks internally.
Why it's wrong here
An automation rule with only the severity equals High condition will run the playbook for every new High-severity incident, including those already assigned to an analyst, because the rule does not filter on the 'Assigned to' property. The playbook would then have to perform an unassigned check internally, but this wastes compute cycles and may cause unnecessary side effects before the condition is evaluated. Placing the unassigned condition in the automation rule pre-filters incidents, ensuring the playbook is only invoked when its actions are actually needed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst is configuring a playbook in Microsoft Sentinel to run automatically when a new incident of severity 'High' is created. The playbook should only run for incidents that are not already assigned to an analyst. How can the analyst configure this automation?
hard- ✓ A.Create an automation rule with a condition on 'Owner' field equals 'Unassigned'
- B.Use a playbook trigger 'When a Microsoft Sentinel incident is created' and add a condition in the playbook
- C.Configure a watchlist to filter incidents
- D.Use a Logic Apps trigger for all incidents and check owner within the playbook
Why A: Microsoft Sentinel automation rules can evaluate incident properties at creation time, including the 'Owner' field. By setting a condition that 'Owner' equals 'Unassigned', the rule triggers the playbook only for high-severity incidents that have not yet been assigned to an analyst, meeting the requirement without requiring custom logic inside the playbook.
Variation 2. A SOC analyst in Microsoft Sentinel needs to create an automation rule that triggers a playbook when a new incident is created and the incident severity is 'High'. Additionally, the playbook should only run if the incident is not already assigned to an analyst. Which two conditions must the analyst include in the automation rule? (Select all that apply.) (Choose 2.)
hard- ✓ A.Condition: 'Severity' equals 'High'
- ✓ B.Condition: 'Assigned to' equals 'null'
- C.Condition: 'Status' equals 'New'
- D.Condition: 'Provider' contains 'Microsoft Sentinel'
Why A: The automation rule must trigger only when the incident severity is 'High'. In Microsoft Sentinel, automation rules evaluate conditions against incident properties, and the 'Severity' condition filters incidents by their assigned severity level. This ensures the playbook runs exclusively for high-severity incidents, aligning with the SOC's requirement to prioritize critical alerts.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.