SC-200 Manage a security operations environment Practice Question
Your organization uses Microsoft Sentinel. You need to design a solution to automatically respond to a specific type of incident by sending an email to the SOC manager and creating a ticket in ServiceNow. What should you use?
⚠ Common exam trap
Many exam-takers confuse automation rules with playbooks, thinking automation rules can directly perform actions like sending emails, when in fact they only orchestrate the triggering of playbooks that contain the actual logic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a playbook in Microsoft Sentinel and trigger it with an automation rule.
Microsoft Sentinel uses Azure Logic Apps-based playbooks to execute complex, multi-step automated responses, such as sending an email and creating a ServiceNow ticket. An automation rule is required to trigger the playbook when an incident meets specific criteria, as analytics rules alone cannot directly invoke external systems like ServiceNow.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an analytics rule that directly sends an email.
Why it's wrong here
Analytics rules are detection queries that evaluate data and generate alerts or incidents; they do not have a built-in action mechanism to send emails. While you can attach automated responses to an incident, email delivery must be handled by a playbook (Logic App), not by the analytics rule itself. Directly sending email from the rule is not supported, so this design is incorrect.
- ✗
Create a workbook that triggers a webhook.
Why it's wrong here
Workbooks in Microsoft Sentinel are interactive reporting canvases that display query results and metrics; they are read-only visualizations and lack the ability to execute an outbound webhook. A webhook can only be triggered by an executable component like a playbook, which is invoked by an automation rule or incident creation. Relying on a workbook for an action is a fundamental design fallacy.
- ✗
Create an automation rule that sends an email and creates a ticket.
Why it's wrong here
Automation rules offer a limited set of incident management actions such as changing status, assigning ownership, or adding tags; they do not natively send emails or create external tickets. To send an email or generate a ticket, an automation rule would need to trigger a playbook that contains the appropriate Logic App connectors. Expecting the automation rule to perform these integrations directly violates Sentinel's architecture.
- ✓
Create a playbook in Microsoft Sentinel and trigger it with an automation rule.
Why this is correct
Playbooks are Azure Logic Apps that can integrate with external systems through connectors, enabling actions like sending email, creating tickets, or posting to chat. An automation rule can be configured to run a playbook automatically when an incident is created or updated, providing a scalable and customizable response. This design correctly separates detection (analytics rule) from orchestration (automation rule + playbook) and is the standard pattern for complex actions.
Go deeper
Related to this question
About these practice questions
One of 1,303 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization is implementing Microsoft Sentinel. You need to design a solution to automatically disable a user account in Microsoft Entra ID when a high-severity incident is triggered in Microsoft Sentinel related to that user. Which component should you use?
easy- ✓ A.A playbook that uses the Microsoft Graph API to disable the user.
- B.An analytics rule that includes a query to disable the user.
- C.An automation rule that runs a PowerShell script on a hybrid worker.
- D.A workbook that triggers a webhook to disable the user.
Why A: A playbook is the correct component because it is an automated workflow that can be triggered by a Microsoft Sentinel incident. By using the Microsoft Graph API within the playbook, you can programmatically disable a user account in Microsoft Entra ID, which is the required action for a high-severity incident. This aligns with the need for an automated response that integrates Sentinel with identity management.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.