SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft Sentinel for security operations. They want to automatically create an incident and assign it to a senior analyst when a high-severity alert is generated. Which feature should they use?
⚠ Common exam trap
A common mix-up: candidates confuse playbooks with automation rules, thinking playbooks are required for incident creation, when in fact automation rules can directly create and assign incidents without needing a playbook.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automation rule
Automation rules in Microsoft Sentinel allow you to automatically trigger incident creation, assignment, and other actions when an alert is generated. By configuring an automation rule with a condition for high-severity alerts, you can set it to create an incident and assign it to a specific senior analyst, streamlining the response process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Analytics rule
Why it's wrong here
Analytics rules in Microsoft Sentinel are designed to detect specific threats or anomalies within ingested data by applying queries and logic. When a rule's conditions are met, it generates a security alert, indicating a potential security event. However, an analytics rule itself does not directly create a Microsoft Sentinel incident or automatically assign it to an analyst; it primarily serves as the detection mechanism.
- ✓
Automation rule
Why this is correct
Automation rules are a core component of Microsoft Sentinel's Security Orchestration, Automation, and Response (SOAR) capabilities, enabling automated responses to alerts and incidents. They can be configured to automatically create incidents from incoming alerts, apply specific tags, change the incident status, and assign the incident to a designated owner or group. This direct capability to create and assign incidents makes them the correct choice for streamlining security operations.
- ✗
Workbook
Why it's wrong here
Microsoft Sentinel Workbooks provide flexible, interactive dashboards and reports for visualizing and analyzing security data. They are instrumental for monitoring security posture, conducting investigations, and presenting insights derived from collected logs and alerts. However, workbooks are purely a visualization and reporting tool and do not possess any inherent functionality to automate the creation or assignment of security incidents.
- ✗
Playbook
Why it's wrong here
Playbooks in Microsoft Sentinel, powered by Azure Logic Apps, are automated, scalable workflows designed to execute complex, multi-step tasks in response to security events. While playbooks can perform a wide array of actions, such as enriching incident data, communicating with external systems, or taking remediation steps, they are typically triggered by automation rules. A playbook does not directly create a Microsoft Sentinel incident or assign it; rather, an automation rule acts as the trigger to initiate a playbook's actions on an existing alert or incident.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Sentinel
Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration automation and response (SOAR) service that helps organizations detect, investigate, and respond to cyber threats across their entire digital estate.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.