Manage a security operations environment →easyMultiple ChoiceObjective-mapped

SC-200 Manage a security operations environment Practice Question

Your SOC team uses Microsoft Sentinel incident management. You need to ensure that when an incident is created, it automatically runs a playbook to gather additional context from threat intelligence sources. What should you create?

⚠ Common exam trap

Watch out — candidates often confuse automation rules with analytics rules, thinking that analytics rules can directly trigger playbooks on incident creation, when in fact automation rules are the dedicated mechanism for incident-triggered playbook execution.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Automation rule with a trigger on incident creation.

Microsoft Sentinel automation rules can be configured with a trigger on incident creation to automatically run a playbook. This allows the SOC team to gather additional context from threat intelligence sources without manual intervention, directly addressing the requirement to execute a playbook when an incident is created.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Workbook that queries threat intelligence.
Why it's wrong here
Workbooks in Microsoft Sentinel are interactive reporting tools that render queries against Log Analytics workspaces for visualization and situational awareness. They are purely passive: displaying threat intelligence data does not invoke any backend automation, and they have no trigger or action engine to execute playbooks when an incident is created. Thus, while a workbook might help an analyst enrich an investigation, it cannot satisfy the requirement to automatically run a playbook on incident creation.
✗
Watchlist that maps to the incident.
Why it's wrong here
A watchlist is a static dataset (e.g., IP addresses, file hashes) stored in Microsoft Sentinel for enrichment and correlation, typically referenced by analytics rules or playbooks during query execution. Mapping a watchlist to an incident is a data-linkage concept, not an automation step; watchlists have no triggers, listeners, or action executors. Consequently, they can support a playbook's logic but cannot initiate any automated response when an incident is generated.
✓
Automation rule with a trigger on incident creation.
Why this is correct
Automation rules are the native orchestration feature in Microsoft Sentinel that let you define conditions and actions executed when an incident meets predefined criteria. By setting the trigger type to 'When incident is created,' the rule fires immediately upon incident generation, and you can configure it to run a playbook, change the incident status, assign ownership, or add tasks. This is the correct and intended mechanism for automatically invoking a playbook at incident creation time.
✗
Analytics rule that generates an alert.
Why it's wrong here
An analytics rule is responsible for querying raw data and generating alerts based on detection logic, and those alerts can later be promoted into incidents. However, the analytics rule itself operates only to produce the alert; it has no direct capability to run playbooks or perform actions when an incident is later created from that alert. Incident-based automation must be handled by automation rules, which are separate constructs that trigger on incident creation events, not by the analytics rule that merely feeds the incident pipeline.

Go deeper

SC-200 Manage a security operations environment Practice Question

Why each option matters

Option-by-option breakdown

Related to this question