SC-200 Manage a security operations environment Practice Question
Your organization uses Microsoft Sentinel. You need to automatically assign incidents to the appropriate SOC tier based on severity. What should you create?
⚠ Common exam trap
Test-takers frequently confuse automation rules with playbooks, assuming that any automated response requires a playbook, when in fact simple owner assignment is a native automation rule action that does not need a separate playbook or Power Automate workflow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An automation rule with an owner assignment action
Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific owners based on conditions like severity, using the 'Assign owner' action. This directly meets the requirement to route incidents to the appropriate SOC tier without manual intervention, leveraging Sentinel's native incident management capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A data connector to Microsoft Teams
Why it's wrong here
Teams connector is for collaboration, not assignment.
- ✗
A scheduled analytics rule
Why it's wrong here
Analytics rules generate alerts, not assign ownership.
- ✗
A playbook in Microsoft Power Automate
Why it's wrong here
A playbook in Microsoft Power Automate is incorrect because Microsoft Sentinel playbooks are built on Azure Logic Apps, not Power Automate, to natively automate incident responses and assignments within Sentinel. While Power Automate can automate workflows and integrate with many services, it is not the native mechanism for Sentinel's incident automation. It would be a suitable choice for general business process automation, potentially triggered by Sentinel, but not for direct incident tier assignment within the platform's incident management system.
- ✓
An automation rule with an owner assignment action
Why this is correct
Automation rules can assign incidents to specific users or groups.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.