Respond to security incidents →mediumMultiple Choice

SC-200 Respond to security incidents Practice Question

Exhibit

Refer to the exhibit.
{
  "properties": {
    "displayName": "Suspicious sign-in alert",
    "enabled": true,
    "triggerOperator": "GreaterThan",
    "triggerThreshold": 0,
    "conditions": [
      {
        "property": "RiskLevelDuringSignIn",
        "operator": "Equals",
        "value": "high"
      }
    ],
    "actions": [
      {
        "actionGroupId": "/subscriptions/.../actionGroups/AG1",
        "webhookProperties": {}
      }
    ]
  }
}

You are reviewing an alert rule in Microsoft Sentinel created via ARM template. What is the primary purpose of this rule?

⚠ Common exam trap

Many exam-takers confuse the purpose of an alert rule with the actions that can be triggered by it, such as automated remediation or incident creation, leading them to select options that describe downstream responses rather than the rule's primary detection function.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

To send an alert when a sign-in with high risk level is detected.

The primary purpose of an alert rule in Microsoft Sentinel created via ARM template is to generate an alert when a specific condition is met, such as a sign-in with a high risk level detected by Microsoft Entra ID Protection. This alert can then be used to trigger automated responses or create incidents, but the rule itself is designed to detect and alert on the defined condition, not to perform remediation actions like isolation or blocking.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
To send an alert when a sign-in with high risk level is detected.
Why this is correct
This is the intended function of the analytics rule: it periodically runs a KQL query over SigninLogs where the risk level is 'high', and when the number of matching sign-ins exceeds the threshold, it generates a Sentinel alert and sends a notification through the configured action group (email, SMS, or ITSM). The action group is the delivery channel, so the rule's purpose is precisely to alert on high-risk sign-in events—not to take any direct remediation or downstream orchestration steps.
✗
To isolate the user's device from the network.
Why it's wrong here
Isolating a user's device from the network requires a Microsoft Defender for Endpoint live-response action, which neither a Sentinel analytics rule nor an Azure Monitor action group can natively execute. To achieve this you would have to attach an automation rule that invokes a Sentinel Playbook (a Logic Apps workflow with the Microsoft 365 Defender connector) that sends a device isolation command, but this alert rule has no such automation bound to it, so it performs no device containment.
✗
To automatically block the user from signing in.
Why it's wrong here
Blocking a user from signing in is a decision on the identity plane, enforceable only through Microsoft Entra ID (Azure AD) Conditional Access—for example, a risk-based policy with 'Block access'—or by temporarily disabling the account. A Sentinel alert rule does not interact with Entra ID authentication policies; its action group merely notifies the response team, and any automated block would require a separate playbook invoking Microsoft Graph, which is not configured here.
✗
To create an incident in Microsoft Sentinel.
Why it's wrong here
A Sentinel analytics rule, when it triggers, produces an Alert (Azure Monitor 'result'), and converting that alert into an Incident is a separate step that depends on the rule's incident-creation toggle or on an automation rule subscribed to alert creation. The action group used here delivers the alert notification and is unrelated to incident generation, so the rule's purpose is neither to create nor to modify incidents.

Go deeper

SC-200 Respond to security incidents Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question