SC-200 Respond to security incidents Practice Question
Your organization uses Microsoft Sentinel. A security incident is generated by a scheduled analytics rule. You need to automatically assign the incident to the SOC team and set its severity. What should you create?
⚠ Common exam trap
Watch out — candidates often confuse automation rules with playbooks, thinking that any automated response requires a playbook, but Microsoft Sentinel specifically uses automation rules for lightweight, built-in incident management actions like assignment and severity changes, reserving playbooks for more complex or multi-step workflows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An automation rule
Automation rules in Microsoft Sentinel allow you to automatically assign incidents to a specific team (e.g., SOC team) and set their severity based on conditions like analytics rule name or incident properties. Unlike playbooks, automation rules are lightweight, run immediately without a Logic Apps connector, and are designed for simple, no-code incident management tasks such as assignment and severity changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An analytics rule
Why it's wrong here
An analytics rule defines detection logic and generates incidents from KQL query matches, but it cannot dynamically assign an incident owner or conditionally adjust severity during the incident creation flow. Although you can configure a static severity level within the rule itself, the requested automatic owner assignment and severity modification are operational actions that occur after the incident is materialized, making the analytics rule the wrong choice for this triage step.
- ✓
An automation rule
Why this is correct
An automation rule is the correct choice because it executes natively and immediately when an incident is created, and it directly supports simple actions such as 'Assign owner' and 'Set severity' through conditions that evaluate incident properties at that moment. Unlike a playbook, it requires no Logic App or separate trigger, so it provides the fastest, most reliable method to impose mandatory ownership and severity settings during initial incident generation, exactly matching the requirement.
- ✗
A workbook
Why it's wrong here
A workbook is a visualization and reporting tool that presents Sentinel data as interactive dashboards, charts, and tables for human analysis. It performs no automated actions and cannot assign owners or modify incident properties in any way; it only reads and displays telemetry, so it is completely unsuitable for applying changes at incident creation.
- ✗
A playbook
Why it's wrong here
A playbook is incorrect because it defines automated actions *after* an incident is created or updated, not the initial properties set by an analytics rule upon generation. The requirement is to automatically assign and set severity *when the incident is generated*. Playbooks are tempting as they perform automation, including incident updates. They would be correct for orchestrating complex response actions, enriching incidents, or re-assigning them based on further conditions *after* initial creation, often triggered by an automation rule or manually.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Sentinel. You have an incident that involves multiple alerts. You want to automatically assign the incident to the appropriate analyst based on the alert type. What should you use?
medium- A.Create a playbook that assigns the incident.
- B.Configure the analytics rule to set the incident owner.
- C.Use a workbook to filter incidents by alert type.
- ✓ D.Create an automation rule with an 'Assign incident to owner' action.
Why D: An automation rule with an 'Assign incident to owner' action is the correct mechanism to automatically assign incidents based on alert type. Automation rules in Microsoft Sentinel support conditions on incident properties (including alert type/analytics rule) and can assign the incident to a specific owner or group. This directly fulfills the requirement.
Variation 2. Your organization uses Microsoft Sentinel. You have a playbook that sends an email notification to the SOC team when a new incident is created. The playbook is currently triggered manually. You want the playbook to run automatically every time an incident of severity High is created. What should you do?
easy- A.Edit the analytics rule that generates the incident to include the playbook as an automated response.
- ✓ B.Create an automation rule that triggers when an incident is created with severity High and runs the playbook.
- C.Modify the playbook to add a trigger of 'When an incident is created' and set the severity condition.
- D.Configure the playbook's Logic Apps designer to use an HTTP trigger that polls Sentinel for new incidents.
Why B: Automation rules in Sentinel can automatically trigger playbooks based on incident conditions. Option A is correct. Option B is wrong because automation rules are created in the Automation blade. Option C is wrong because the analytics rule does not directly run playbooks. Option D is wrong because the playbook trigger is not configured in Logic Apps designer.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.