SC-200 Manage a security operations environment Practice Question
Your organization uses Microsoft Sentinel. You need to ensure that an incident is automatically assigned to the appropriate team based on the type of alert. What should you configure?
⚠ Common exam trap
Candidates often confuse Playbooks (which can also assign incidents via Logic Apps) with Automation rules, but Automation rules are the native, simpler, and more efficient method for straightforward assignment tasks, while Playbooks are better for complex multi-step workflows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automation rule
Automation rules in Microsoft Sentinel allow you to automatically assign incidents to specific teams based on conditions such as alert type or severity. This is the correct configuration because automation rules can trigger actions like incident assignment, tagging, or status changes without requiring a complex logic app or custom code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Workbook
Why it's wrong here
Workbooks are Azure Monitor-based dashboards that aggregate and visualize Sentinel data, such as attack maps or KPI trends. They provide read-only situational awareness but have no execution context to affect incident properties or ownership. Incident routing requires a backend action that runs at incident creation time, which a workbook cannot perform.
- ✗
Playbook
Why it's wrong here
Playbooks automate specific actions in response to an incident, such as enriching data, notifying stakeholders, or initiating remediation steps. They are tempting because they provide automation, but they do not define the initial incident creation or assignment logic based on the alert type that generates the incident. That initial assignment mechanism is handled by an Automation Rule, which applies conditions and actions *during* incident creation. A Playbook would be correct if the requirement was to perform a subsequent automated action *after* an incident has already been created and assigned.
- ✗
Analytics rule
Why it's wrong here
Analytics rules define the detection logic that creates alerts when queried events match suspicious patterns. They are the trigger source for incidents, but their scope ends at alert generation; they do not orchestrate post-detection actions. Assigning an owner to an incident is an incident-management workflow that occurs after the alert is generated and is handled by automation rules, not analytics rules.
- ✓
Automation rule
Why this is correct
Automation rules in Microsoft Sentinel can be configured to trigger on alert creation and use conditions such as alert name or severity to automatically assign incidents to a specific team via the "Assign owner" action. This satisfies the stem’s constraint of routing incidents based on alert type without requiring manual triage or separate playbook logic.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 209 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Sentinel. You need to ensure that an incident is automatically assigned to a specific analyst when it is created. What should you create?
easy- A.An analytics rule with an output to a specific user.
- B.A playbook triggered by incident creation.
- ✓ C.An automation rule with an 'Assign incident' action.
- D.A watchlist that maps incident types to owners.
Why C: An automation rule in Microsoft Sentinel can be configured to run when an incident is created and includes an 'Assign incident' action that automatically assigns the incident to a specific analyst or group. This is the native, no-code method for incident assignment without requiring external logic or playbooks.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.