Quick Answer
The answer is that automation rules in Microsoft Sentinel can perform actions including adding a tag to an incident, assigning incidents to an owner, and running a playbook. These actions are correct because automation rules are designed to streamline incident response by automatically applying predefined workflows based on triggers like incident creation or update, allowing analysts to focus on investigation rather than manual triage. On the SC-200 exam, this topic tests your understanding of how automation rules differ from analytics rules and playbooks, often appearing in multiple-choice questions where a common trap is confusing run playbook with run a query or change a status. A key memory tip is to remember the three core actions as TAP: Tag, Assign, and Playbook, which covers the only incident-level modifications automation rules can directly apply without requiring a Logic App.
This SC-200 practice question tests your understanding of manage a security operations environment. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which THREE actions can be performed by automation rules in Microsoft Sentinel?
Modify a data connector to ingest more logs
Why wrong: Data connectors are not modified by automation rules.
Create a new analytics rule
Why wrong: Creating analytics rules is not an automation rule action.
Assign an incident to a specific owner
Automation rules have an 'Assign owner' action.
Run a playbook on an incident
Automation rules can trigger playbooks.
Add a tag to an incident
Automation rules can add tags.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Assign an incident to a specific owner
Option C is correct because automation rules in Microsoft Sentinel can automatically assign incidents to specific owners based on conditions such as severity, entity type, or custom criteria. This action helps streamline incident response by ensuring the right personnel are notified and responsible for handling the incident without manual intervention.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Modify a data connector to ingest more logs
Why it's wrong here
Data connectors are not modified by automation rules.
Create a new analytics rule
Why it's wrong here
Creating analytics rules is not an automation rule action.
Assign an incident to a specific owner
Why this is correct
Automation rules have an 'Assign owner' action.
Related concept
Read the scenario before looking for a memorised answer.
Run a playbook on an incident
Why this is correct
Automation rules can trigger playbooks.
Related concept
Read the scenario before looking for a memorised answer.
Add a tag to an incident
Why this is correct
Automation rules can add tags.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
The trap here is that candidates may confuse automation rules with analytics rules or data connectors, assuming automation rules can modify data sources or create detection logic, when in fact automation rules are limited to post-ingestion incident management actions.
Detailed technical explanation
Automation rules in Microsoft Sentinel are triggered by incident creation or update events and can execute a sequence of actions including changing incident status, assigning ownership, adding tags, or running playbooks. They use a trigger condition based on properties like severity, tactics, or entity types, and support multiple actions in a single rule, which is evaluated in order of priority. This allows for automated triage and enrichment without requiring custom code or manual steps.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Manage a security operations environment — study guide chapter
Learn the concepts, then practise the questions
Manage a security operations environment practice questions
Targeted practice on this topic area only
All SC-200 questions
1,639 questions across all exam domains
Microsoft Security Operations Analyst SC-200 study guide
Full concept coverage aligned to exam objectives
SC-200 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SC-200 questions linked to Manage a security operations environment.
Practise SC-200 questions linked to Respond to security incidents.
Practise SC-200 questions linked to Perform threat hunting.
Practise SC-200 questions linked to Mitigate threats using Microsoft Defender XDR.
Practise SC-200 questions linked to Mitigate threats using Microsoft Defender for Cloud.
Practise SC-200 questions linked to Mitigate threats using Microsoft Sentinel.
Practise SC-200 questions linked to SC-200 fundamentals.
Practise SC-200 questions linked to SC-200 scenario.
Practise SC-200 questions linked to SC-200 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Manage a security operations environment — This question tests Manage a security operations environment — Read the scenario before looking for a memorised answer..
The correct answer is: Assign an incident to a specific owner — Option C is correct because automation rules in Microsoft Sentinel can automatically assign incidents to specific owners based on conditions such as severity, entity type, or custom criteria. This action helps streamline incident response by ensuring the right personnel are notified and responsible for handling the incident without manual intervention.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO actions are valid for automation rules in Microsoft Sentinel? (Choose two.)
hardWhy A: Options A and D are correct because automation rules can run playbooks and change incident severity. Option B is incorrect because automation rules do not modify analytics rules. Option C is incorrect because automation rules do not delete incidents. Option E is incorrect because automation rules do not add tags directly (tags can be added via playbooks).
Variation 2. Which TWO of the following are valid actions that can be performed by an automation rule in Microsoft Sentinel? (Select two.)
mediumWhy D: Option A and Option C are correct. Automation rules can assign incidents to analysts and run playbooks. Option B is wrong because automation rules do not modify analytics rules. Option D is wrong because automation rules can close incidents, not just create tasks. Option E is wrong because automation rules do not delete watchlists.
Variation 3. Which TWO actions can a Microsoft Sentinel automation rule perform when an incident is created?
easyWhy C: Microsoft Sentinel automation rules can trigger actions when an incident is created, including running a playbook (Option C) and changing the incident severity (Option D). Playbooks are automated workflows based on Azure Logic Apps that can perform complex response actions, while severity changes allow dynamic triage based on incident properties.
Variation 4. Which TWO actions can you perform using Microsoft Sentinel automation rules? (Select two.)
mediumWhy A: Option A is correct because Microsoft Sentinel automation rules can create tasks on incidents. This allows you to automatically assign investigation steps or remediation actions to specific personnel, ensuring consistent incident response workflows.
Variation 5. Which TWO actions can you perform using Microsoft Sentinel automation rules?
mediumWhy B: Option B is correct because Microsoft Sentinel automation rules can directly assign an incident to a specific analyst using the 'Assign owner' action. This allows security operations teams to automatically route incidents to the appropriate personnel based on criteria such as severity, tactic, or entity, improving response efficiency.
Variation 6. Which TWO actions can you perform using Microsoft Sentinel automation rules?
mediumWhy C: Automation rules in Microsoft Sentinel allow you to automatically manage incidents by changing their status (e.g., from 'New' to 'Active' or 'Closed') based on conditions like severity or title. They can also trigger playbooks (automated response workflows) when incidents are created or updated, enabling actions such as enrichment, investigation, or remediation. These capabilities are defined in the automation rule's 'Actions' section, where you set the incident status or select a playbook to run.
Variation 7. Which THREE actions can you perform using Microsoft Sentinel automation rules?
hardWhy C: Correct options are A, B, and D. Automation rules can change incident severity, assign incidents, and run playbooks. Option C is done by analytics rule templates, not automation rules. Option E is done by threat intelligence indicators.
Variation 8. Which TWO actions can be performed using Microsoft Sentinel automation rules? (Select TWO.)
mediumWhy A: Options A and C are correct because automation rules can assign incidents to owners and run playbooks. Option B is wrong because automation rules do not create analytics rules. Option D is wrong because automation rules do not modify data connectors. Option E is wrong because automation rules do not create watchlists.
Last reviewed: Jun 25, 2026
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.