hardMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC analyst is creating an automation rule in…
A SOC analyst is creating an automation rule in Microsoft Sentinel to trigger a playbook when a new incident is created. The analyst wants the rule to apply only to incidents that have a severity of 'High' and where the 'User' entity is present. Which condition configuration should the analyst use?
⚠ Common exam trap
Many candidates confuse incident-level conditions (severity, entity type) with alert-level conditions (alert severity, alert entity type), leading them to select Option C, which would not work because automation rules evaluate at the incident scope.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set 'Incident severity equals High' and 'Entity type contains User'
Microsoft Sentinel automation rules evaluate conditions at the incident level, not the alert level. The 'Incident severity equals High' condition filters by incident severity, and 'Entity type contains User' checks that the incident's entities include a User entity, which is required for the playbook to receive entity context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set 'Incident severity equals High' and 'Incident tag contains User'
Why it's wrong here
This condition is incorrect because tags are free-form labels applied to incidents, not structured entity types. The presence of a tag containing the word 'User' does not guarantee that an actual user entity is attached to the incident, and automation rules cannot infer entity presence from tag strings. To satisfy the requirement, you must explicitly check the incident's Entity type field for 'User'.
- ✓
Set 'Incident severity equals High' and 'Entity type contains User'
Why this is correct
This is the correct condition set because automation rules in Microsoft Sentinel trigger on incidents, and they can evaluate incident-level properties such as Incident severity and Entity type. The 'Entity type contains User' condition checks the first-class entities associated with the incident, ensuring the rule only runs on high-severity incidents that actually include a user entity, which is precisely what the requirement asks for.
- ✗
Set 'Alert severity equals High' and 'Alert entity type contains User'
Why it's wrong here
This is wrong because automation rules operate at the incident level, not the alert level. While alerts have their own severity and entity-type fields, automation rules do not expose these alert-level properties as condition options; they only work with incident-level fields. Even if you could reference alert severity, the rule would need to aggregate across multiple alerts, so the correct approach is to use Incident severity and incident-level Entity type.
- ✗
Set 'Incident provider equals Microsoft Sentinel' and 'Entity type contains User'
Why it's wrong here
This condition omits the required severity filter and instead checks the incident provider, which is not relevant to the stated requirement. The provider field identifies the source product (e.g., Microsoft Sentinel, Microsoft Defender for Office 365) but does not convey any information about severity. As a result, the rule would incorrectly trigger on low- and medium-severity incidents that contain a user entity, failing to match the intended high-severity scope.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.