SC-200 Respond to security incidents Practice Question
Which THREE actions can you take in Microsoft Sentinel to respond to an incident?
⚠ Common exam trap
Watch out — candidates often confuse actions that configure detection (like modifying analytics rules) or manage data (like exporting logs) with direct incident response actions, which are limited to triage, investigation, and remediation steps within the incident interface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the incident to a user
Assigning an incident to a user is a core incident response action in Microsoft Sentinel. It establishes ownership, ensuring a specific analyst is responsible for investigation and remediation. This action is performed directly from the incident details pane and is a fundamental step in managing the incident lifecycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign the incident to a user
Why this is correct
Assigning an incident to a user is a valid incident management action that designates an owner responsible for investigation and resolution. It establishes accountability, enables tracking of workload, and allows metrics to be based on individual or team performance, all within the Microsoft Sentinel incident workspace.
- ✓
Create an automation rule
Why this is correct
Creating an automation rule in Microsoft Sentinel is a permitted response action because it can trigger immediate, predefined actions such as tag additions, assignment changes, or playbook runs when an incident is created or updated. These rules operationalize response by automating consistent reactions to specific conditions, reducing manual effort and response time.
- ✓
Run a playbook
Why this is correct
Running a playbook on an incident is a legitimate response action because playbooks are Azure Logic Apps-based workflows that can execute investigative or remediation steps, such as hunting queries, user isolation, or notification to engineering teams. Playbooks provide a repeatable, auditable mechanism for applying complex security operations directly to an incident.
- ✗
Modify a KQL query in an analytics rule
Why it's wrong here
Modifying a KQL query in an analytics rule is not an immediate incident response action; it changes the detection logic for future alerts, not the handling of the current incident. While adjusting the query can improve detection or reduce noise, it does not impact an already-generated incident's status or perform any direct remediation.
- ✗
Export logs to Azure Storage
Why it's wrong here
Exporting logs to Azure Storage is a data management and retention tactic, not a response action within Microsoft Sentinel incident management. It serves long-term archival or compliance needs, but it neither acts on the incident itself nor mitigates any threat, making it irrelevant to the question of what actions can be taken against an incident.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO are valid incident response actions in Microsoft Sentinel?
easy- ✓ A.Change the incident status to Active.
- B.Run a KQL query from the incident.
- ✓ C.Assign the incident to an analyst.
- D.Merge the incident with another incident.
- E.Add a comment to the incident.
Why A: Option A is correct because Microsoft Sentinel incidents have a status field (New, Active, Closed) and changing an incident's status to Active is a standard triage action that indicates the incident is being investigated. Option C is correct because incidents can be assigned to an owner (an analyst) in Microsoft Sentinel, which is a core incident-management action for routing and accountability. Option B is not a valid incident response action in this context because running a KQL query is done in Logs/Log Analytics, not as an action on the incident itself. Option D is not valid because Microsoft Sentinel does not provide a merge operation for incidents; related alerts can be grouped into an incident, but incidents cannot be merged. Option E is not valid because adding a comment is not an incident response action available on the incident in Microsoft Sentinel.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.