Manage a security operations environment →easyMultiple Choice

SC-200 Manage a security operations environment Practice Question

Exhibit

Refer to the exhibit.
{
  "properties": {
    "displayName": "SOC Automation Rule",
    "order": 1,
    "triggeringLogic": {
      "triggersOn": "Incidents",
      "triggersWhen": "Created",
      "conditions": [
        {
          "property": "Status",
          "operator": "Equals",
          "value": "New"
        }
      ]
    },
    "actions": [
      {
        "actionType": "ChangeStatus",
        "status": "Active"
      }
    ]
  }
}

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. What is the effect of this rule?

⚠ Common exam trap

Watch out — candidates often confuse the 'Change status' action with other common actions like assignment or task creation, or assume that changing status to 'Active' automatically implies assignment to a team.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It changes the status of newly created incidents from 'New' to 'Active'.

The automation rule is configured to run when an incident is created, and the action taken is to change the incident status from 'New' to 'Active'. This is a common initial triage step to indicate that the incident is being worked on, rather than leaving it in the default 'New' state. The rule does not assign ownership, suppress incidents, or create tasks.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
It assigns the incident to the SOC team.
Why it's wrong here
The automation rule shown contains no 'Assign owner' action, which is the specific action that would set the incident's owner to the SOC team. Without that action, the rule cannot perform any ownership assignment. Changing the status to 'Active' does not implicitly assign an owner; owner assignment requires an explicit action in the rule definition.
✓
It changes the status of newly created incidents from 'New' to 'Active'.
Why this is correct
The rule is configured with an action of type 'ChangeStatus' and the status is set to 'Active'. Because the trigger is 'When incident is created,' this action executes immediately for every new incident that meets the rule's conditions, changing its status from the default 'New' to 'Active.' This is the direct and intended effect of the rule, as distinct from other possible actions like assignment or task creation.
✗
It suppresses the incident if it is a false positive.
Why it's wrong here
There is no 'Suppress incident' action in this automation rule, nor do automation rules support suppressing incidents as a built-in action. Suppression in Microsoft Sentinel is typically configured at the analytics rule level (e.g., stopping and re-running an alert) or handled by a playbook that closes the incident as a false positive. Since the rule only changes the incident status, it cannot suppress anything, and a status of 'Active' actually keeps the incident visible for investigation.
✗
It creates a task in the incident for investigation.
Why it's wrong here
The rule does not include a 'Create task' action. Microsoft Sentinel automation rules can create investigation tasks for analysts, but that requires the specific action type 'Create task' with a task title and description. This rule's only visible action is 'ChangeStatus,' so it does not add any tasks to the incident.

Go deeper

SC-200 Manage a security operations environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question