Courseiva
← SC-200
Full test
mediumMultiple ChoiceObjective-mapped

SC-200 Practice Question: A SOC team wants to automatically categorize…

A SOC team wants to automatically categorize incidents in Microsoft Sentinel with MITRE ATT&CK tactics (e.g., 'Initial Access', 'Execution') when an analytics rule triggers. How can they achieve this?

⚠ Common exam trap

Microsoft often tests the distinction between native analytics rule configuration (which directly sets MITRE ATT&CK tactics) versus post-processing methods like automation rules or playbooks, leading candidates to overcomplicate the solution when the simplest, built-in option is correct.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Map MITRE ATT&CK tactics in the analytics rule

Microsoft Sentinel analytics rules include a dedicated 'MITRE ATT&CK' configuration section where you can map specific tactics (e.g., Initial Access, Execution) to the rule. When the rule triggers and generates an incident, Sentinel automatically populates the incident's MITRE ATT&CK tactics field based on this mapping, enabling automated categorization without additional configuration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Use the incident details custom fields

    Why it's wrong here

    Incident details custom fields are user-defined key/value pairs that can store supplementary data like ticket numbers or asset tags, but they are not automatically populated from the analytics rule's MITRE ATT&CK configuration. The tactic information is placed into the incident's built-in MITRE ATT&CK fields (techniques and tactics) by the analytics rule engine when the rule is triggered; custom fields simply remain empty unless a playbook or manual process explicitly writes to them. Therefore, relying on custom fields does not satisfy the requirement to automatically categorize incidents by tactic and would require additional logic to copy values.

  • ✓

    Map MITRE ATT&CK tactics in the analytics rule

    Why this is correct

    The analytics rule in Microsoft Sentinel includes a configuration pane where you can select one or more MITRE ATT&CK tactics and techniques (such as Initial Access, Execution, or Command and Control) that the rule is designed to detect. When the rule fires and creates an incident, the selected tactics are automatically applied to the incident's MITRE ATT&CK fields, enabling immediate categorization and correlation with other threat intelligence. This is the intended, first-party mechanism for tagging incidents with tactics, and it requires no additional overhead or post-processing, making it the correct and most reliable approach for automatic categorization.

  • ✗

    Use automation rule to set tactics

    Why it's wrong here

    Automation rules in Microsoft Sentinel run after an incident is created and can perform actions like changing status, assigning ownership, or triggering a playbook, but they do not expose a direct action to set or modify the MITRE ATT&CK tactic fields on an incident. The MITRE ATT&CK fields are read-only within the automation rule action list, and altering them would require invoking a playbook or logic app to update the incident via the API, which is not the native purpose of automation rules. Thus, while automation rules can orchestrate response workflows, they cannot serve as the primary mechanism for initially categorizing incidents by tactic—that mapping must be defined in the analytics rule itself.

  • ✗

    Use playbook to update incident

    Why it's wrong here

    Although a playbook—an Azure Logic Apps-based workflow—could use the Microsoft Sentinel API to update an incident's MITRE ATT&CK tactic fields after the incident is created, this approach is indirect, latency-inducing, and error-prone because it depends on the playbook being triggered by an automation rule and correctly parsing the incident's context. It also introduces extra moving parts and potential failure points compared to the declarative configuration in the analytics rule, which natively stamps the tactics at incident creation time. For automatic categorization that is immediate and consistently applied, mapping tactics directly in the analytics rule is far more efficient, making the playbook approach an unnecessary and less reliable workaround.

About these practice questions

This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.