SC-200 Manage a security operations environment Practice Question
Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud Apps to monitor cloud application usage. You have a custom analytics rule that detects multiple failed login attempts from different IP addresses for the same user within 5 minutes. This rule generates an incident. The security team wants to automatically suspend the user in Microsoft Entra ID (formerly Azure AD) when such an incident is created, but only if the user is not a member of the 'Emergency Access' group. You need to implement this automation. You have already created the analytics rule. What should you do next?
⚠ Common exam trap
SC-200 often tests the boundary between automation rules (which can only trigger playbooks or set incident metadata) and playbooks (which perform the actual API actions), so candidates wrongly pick an automation rule that 'suspends the user directly'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a playbook that uses the Microsoft Entra ID connector to check if the user is a member of the 'Emergency Access' group. If not, suspend the user. Then create an automation rule that runs this playbook on incident creation.
The requirement has two parts: conditional logic (check Emergency Access group membership) and an action (suspend the user). Playbooks are the only Sentinel component that can run arbitrary logic and call the Microsoft Entra ID connector to both check group membership and disable the account. The automation rule then binds that playbook to incident creation, giving the correct end-to-end flow.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the analytics rule to include a condition that checks the user's group membership using KQL.
Why it's wrong here
KQL conditions inside an analytics rule only filter which alerts generate incidents; they cannot call Microsoft Entra ID to disable an account. Group-membership checks and user suspension require a playbook triggered by the incident, where an automation rule can pass the account context to Microsoft Entra ID.
- ✗
Create an automation rule that suspends the user directly using a condition on the incident.
Why it's wrong here
Automation rules can only run playbooks or change incident properties; they cannot call Microsoft Graph to suspend an account, and they cannot evaluate Entra ID group membership. Automation rules are tempting because they trigger directly on incident creation, which would suffice if the action were merely tagging or closing the incident.
- ✗
Create an automation rule that triggers on incident creation and runs a playbook that suspends the user.
Why it's wrong here
A playbook alone cannot filter out Emergency Access members unless the automation rule's condition checks group membership, which automation rules cannot query in Microsoft Entra ID. Playbooks are tempting because they run the Graph call to suspend the user, and would be correct if the exclusion were handled inside the playbook logic.
- ✓
Create a playbook that uses the Microsoft Entra ID connector to check if the user is a member of the 'Emergency Access' group. If not, suspend the user. Then create an automation rule that runs this playbook on incident creation.
Why this is correct
A playbook performs the conditional group check and suspension, satisfying the requirement to exclude Emergency Access members. The automation rule triggers it on incident creation, since analytics rules alone cannot execute remediation actions or query group membership dynamically.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.