Manage a security operations environment →mediumMultiple ChoiceObjective-mapped

SC-200 Manage a security operations environment Practice Question

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. A new security policy requires that all incidents involving 'Credential Access' tactics be automatically assigned to the Tier 1 SOC team and have a severity of 'High'. You need to configure this automation. What should you do?

⚠ Common exam trap

Watch out — candidates often confuse automation rules (incident-level) with automated investigation rules (Defender XDR) or think that analytics rules can directly assign incidents, when in fact automation rules are the correct post-creation mechanism for assignment and severity changes.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create an automation rule in Microsoft Sentinel with conditions for tactic 'Credential Access' and actions to assign to Tier 1 SOC and set severity to High.

Automation rules in Microsoft Sentinel allow you to define conditions based on incident properties, such as tactic, and then trigger actions like assigning the incident to a specific owner (Tier 1 SOC) and setting the severity. This directly meets the policy requirement without requiring external playbooks or modifying analytics rules.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Configure an automated investigation rule in Microsoft Defender XDR to assign incidents.
Why it's wrong here
Incorrect: Microsoft Defender XDR doesn't manage Sentinel incidents.
✗
Create a playbook in Microsoft Sentinel that runs on incident creation and assigns the incident to Tier 1 SOC.
Why it's wrong here
Incorrect: Playbooks are triggered by automation rules, not directly by incident creation.
✓
Create an automation rule in Microsoft Sentinel with conditions for tactic 'Credential Access' and actions to assign to Tier 1 SOC and set severity to High.
Why this is correct
Correct: Automation rules can set incident properties based on conditions.
✗
Modify the analytics rule that generates the incidents to include the assignment and severity settings.
Why it's wrong here
Incorrect: Analytics rules define conditions but don't assign owners or modify severity after incident creation.

Go deeper

SC-200 Manage a security operations environment Practice Question

Why each option matters

Option-by-option breakdown

Related to this question