SC-200 Manage a security operations environment Practice Question
This SC-200 practice question tests your understanding of manage a security operations environment. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are managing a Microsoft Sentinel environment. You need to ensure that incidents are automatically assigned to the appropriate analyst based on the type of attack. The assignment must consider the current workload of each analyst. What should you use?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an automation rule with a playbook that queries the current incident assignments and assigns to the least busy analyst.
Option B is correct because automation rules in Microsoft Sentinel can trigger a playbook (Azure Logic App) that queries the current incident assignments and assigns the incident to the analyst with the fewest active incidents. This satisfies both the attack-type mapping (via the analytics rule that generates the incident) and the workload-balancing requirement, as the playbook can dynamically evaluate workload using Azure Resource Graph or Sentinel's API.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Configure multiple analytics rules, each with a different incident owner.
Why it's wrong here
Analytics rules trigger incidents, not assign them.
✓
Use an automation rule with a playbook that queries the current incident assignments and assigns to the least busy analyst.
Why this is correct
Automation rules with playbooks can handle dynamic assignment.
Related concept
Read the scenario before looking for a memorised answer.
✗
Create a watchlist that maps attack types to analyst names and use it in an analytics rule.
Why it's wrong here
Watchlists are reference data, not for dynamic assignment.
✗
Create a workbook that shows analyst workload and manually assign.
Why it's wrong here
Workbook is for visualization, not automation.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse static assignment (Option A or C) with dynamic assignment, failing to realize that only a playbook can query real-time workload data and make a runtime decision based on it.
Detailed technical explanation
How to think about this question
Under the hood, the playbook uses the Microsoft Sentinel connector in Azure Logic Apps to call the 'List incidents' API with a filter for assigned analysts, then calculates the count per analyst. It then updates the incident's owner via the 'Update incident' action. In a real-world scenario, you would also incorporate a fallback logic (e.g., if all analysts are equally busy, assign to the most senior) and handle concurrency to avoid race conditions when multiple incidents trigger simultaneously.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-200 question in full detail.
Manage a security operations environment — This question tests Manage a security operations environment — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use an automation rule with a playbook that queries the current incident assignments and assigns to the least busy analyst. — Option B is correct because automation rules in Microsoft Sentinel can trigger a playbook (Azure Logic App) that queries the current incident assignments and assigns the incident to the analyst with the fewest active incidents. This satisfies both the attack-type mapping (via the analytics rule that generates the incident) and the workload-balancing requirement, as the playbook can dynamically evaluate workload using Azure Resource Graph or Sentinel's API.
What should I do if I get this SC-200 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.