Question 990 of 1,038
SC-200 Respond to security incidents Practice Question
Your organization uses Microsoft Sentinel with the Microsoft Defender XDR connector. You have a critical incident that involves multiple alerts across different services. The incident is being updated with new alerts. You need to ensure that a specific playbook runs only when the incident severity is updated to High. How should you configure the automation rule?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the trigger to 'When incident is updated' and add a condition on severity equals High.
Automation rules can trigger on incident update and filter by severity. Option A is wrong because condition 'when incident is created' would not trigger on update. Option C is wrong because the trigger condition should be on incident update, not alert creation. Option D is wrong because automation rules are not configured inside playbooks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the trigger to 'When an alert is created' and filter for alerts with High severity.
Why it's wrong here
The requirement is to run on incident update, not on alert creation.
- ✓
Set the trigger to 'When incident is updated' and add a condition on severity equals High.
Why this is correct
This triggers the playbook only when the incident is updated to High severity.
- ✗
Set the trigger to 'When incident is created' and add a condition on severity equals High.
Why it's wrong here
This would trigger only on creation, not on updates.
- ✗
Configure the condition inside the playbook to check severity and exit if not High.
Why it's wrong here
Conditions in playbooks are less efficient; automation rules are the correct place.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 21, 2026
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.