SC-200 Manage a security operations environment Practice Question
You are a security operations analyst at a company that uses Microsoft Defender XDR and Microsoft Sentinel. You have configured a custom detection rule in Microsoft Defender XDR that uses a KQL query to detect suspicious PowerShell activity. The rule triggers an alert, but you want to automatically create an incident in Microsoft Sentinel and run a playbook that isolates the affected device. You have already set up the Microsoft Defender XDR connector in Sentinel and enabled incident creation from Defender XDR alerts. However, the playbook does not run automatically when a Defender XDR incident is created. You have verified that the playbook is properly configured and has the correct permissions. What should you do?
⚠ Common exam trap
Test-takers frequently assume playbooks can be triggered directly from Defender XDR or via the connector settings, but Sentinel automation rules are the only way to automatically run a playbook when a Defender XDR incident is created in Sentinel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an automation rule in Microsoft Sentinel that triggers on incident creation and runs the playbook.
In Microsoft Sentinel, automation rules are the mechanism to trigger playbooks automatically when incidents are created or updated. Since the Defender XDR connector is already enabled and creating incidents in Sentinel, the missing piece is an automation rule in Sentinel that runs the playbook on incident creation. The playbook itself is properly configured, so the automation rule bridges the gap between incident creation and playbook execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an automation rule in Microsoft Defender XDR to run the playbook.
Why it's wrong here
Microsoft Defender XDR does not expose an automation rule surface; automation rules are a Microsoft Sentinel orchestration construct that bind incident triggers to Azure Logic Apps playbooks. Defender XDR's incident management lacks this native capability, so while it can surface incidents and even invoke playbooks through manual actions or via Sentinel incident sync, you cannot create a Sentinel-style automation rule directly in the Defender XDR portal. Consequently, attempting to create an automation rule in Defender XDR is not a supported operation.
- ✓
Create an automation rule in Microsoft Sentinel that triggers on incident creation and runs the playbook.
Why this is correct
Microsoft Sentinel's automation rules provide the exact trigger mechanism needed here: you define a rule that fires on incident creation and set an action to run the specified Azure Logic Apps playbook. When Sentinel ingests Defender incidents via the Microsoft Defender XDR connector, the automation rule evaluates the incident creation event and invokes the playbook with the relevant incident data. This is the supported, intended pattern for automating playbook execution when an incident is created in Sentinel, making this option correct.
- ✗
Modify the Microsoft Defender XDR data connector in Sentinel to enable playbook execution.
Why it's wrong here
The Microsoft Defender XDR data connector in Sentinel is an ingestion pipeline that imports alerts and incidents from Microsoft Defender 365 into Sentinel tables; it does not contain any configuration for orchestrating Azure Logic Apps or executing playbooks. Playbook execution is controlled exclusively by automation rules and the Logic Apps trigger, not by the connector's settings. Enabling or modifying that connector only changes which Defender signals are collected—it never 'enables' playbook execution, so this option misinterprets the connector's role.
- ✗
Modify the custom detection rule in Defender XDR to include a 'run playbook' action.
Why it's wrong here
Custom detection rules in Microsoft Defender XDR are written in KQL for advanced hunting and are designed to generate alerts when a suspicious event pattern is matched; they do not expose a 'run playbook' action on the alert or incident they produce. To run a playbook, you need an incident-level automation rule in Sentinel (or a similar orchestration layer), not a detection rule action. The Defender XDR rule editor does not support embedding a playbook invocation within a detection rule, so modifying the custom detection rule cannot achieve the desired result.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 673 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.