Courseiva

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

A company uses Microsoft Sentinel for security operations. They want to automatically create an incident and assign it to a senior analyst when a high-severity alert is generated. Which feature should they use?

⚠ Common exam trap

A common mix-up: candidates confuse playbooks with automation rules, thinking playbooks are required for incident creation, when in fact automation rules can directly create and assign incidents without needing a playbook.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Automation rule

Automation rules in Microsoft Sentinel allow you to automatically trigger incident creation, assignment, and other actions when an alert is generated. By configuring an automation rule with a condition for high-severity alerts, you can set it to create an incident and assign it to a specific senior analyst, streamlining the response process.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Analytics rule

    Why it's wrong here

    Analytics rules in Microsoft Sentinel are designed to detect specific threats or anomalies within ingested data by applying queries and logic. When a rule's conditions are met, it generates a security alert, indicating a potential security event. However, an analytics rule itself does not directly create a Microsoft Sentinel incident or automatically assign it to an analyst; it primarily serves as the detection mechanism.

  • Automation rule

    Why this is correct

    Automation rules are a core component of Microsoft Sentinel's Security Orchestration, Automation, and Response (SOAR) capabilities, enabling automated responses to alerts and incidents. They can be configured to automatically create incidents from incoming alerts, apply specific tags, change the incident status, and assign the incident to a designated owner or group. This direct capability to create and assign incidents makes them the correct choice for streamlining security operations.

  • Workbook

    Why it's wrong here

    Microsoft Sentinel Workbooks provide flexible, interactive dashboards and reports for visualizing and analyzing security data. They are instrumental for monitoring security posture, conducting investigations, and presenting insights derived from collected logs and alerts. However, workbooks are purely a visualization and reporting tool and do not possess any inherent functionality to automate the creation or assignment of security incidents.

  • Playbook

    Why it's wrong here

    Playbooks in Microsoft Sentinel, powered by Azure Logic Apps, are automated, scalable workflows designed to execute complex, multi-step tasks in response to security events. While playbooks can perform a wide array of actions, such as enriching incident data, communicating with external systems, or taking remediation steps, they are typically triggered by automation rules. A playbook does not directly create a Microsoft Sentinel incident or assign it; rather, an automation rule acts as the trigger to initiate a playbook's actions on an existing alert or incident.

About these practice questions

One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.