SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A financial institution is deploying Microsoft Sentinel to monitor security events across its hybrid cloud environment. They want to correlate alerts from multiple sources and automate incident response. Which Microsoft Sentinel feature should they use to create automated workflows?
⚠ Common exam trap
It's easy for candidates to confuse the purpose of Analytics rules (alert generation) with Playbooks (automated response), as both are part of the detection and response pipeline but serve distinct roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Playbooks
Playbooks in Microsoft Sentinel are built on Azure Logic Apps and allow you to automate incident response by defining a series of actions triggered by alerts. They can orchestrate tasks such as blocking IPs, opening tickets, or notifying teams, making them the correct choice for creating automated workflows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Workbooks
Why it's wrong here
Workbooks in Microsoft Sentinel provide flexible, interactive dashboards for visualizing security data, threat intelligence, and incident metrics. They allow security analysts to create custom reports and gain insights into their environment through various charts and tables. However, Workbooks are purely for data presentation and analysis; they do not possess any capabilities to automatically trigger actions or execute incident response workflows.
- ✗
Analytics rules
Why it's wrong here
Analytics rules in Microsoft Sentinel are designed to detect threats and suspicious activities by running scheduled queries against ingested log data. When a query condition is met, an alert is generated, which can then create an incident. While crucial for threat detection, analytics rules themselves are solely responsible for identifying patterns and generating alerts; they do not directly execute automated remediation steps or response actions.
- ✓
Playbooks
Why this is correct
Playbooks in Microsoft Sentinel, powered by Azure Logic Apps, are automated, scalable, and customizable workflows designed to orchestrate and automate incident response tasks. They can be triggered by analytics rules, incidents, or manual actions, performing predefined actions such as enriching incident data, blocking malicious IP addresses, isolating compromised hosts, or notifying security teams via various communication channels. This automation significantly reduces manual effort and accelerates response times.
- ✗
Hunting queries
Why it's wrong here
Hunting queries are specialized Kusto Query Language (KQL) queries used by security analysts to proactively search for unknown threats or suspicious activities that might have evaded automated detection. These queries are part of a manual, iterative process of threat hunting, allowing analysts to explore raw data for subtle indicators of compromise. While vital for uncovering stealthy threats, hunting queries are an investigative tool and do not automate any incident response or remediation actions.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic in real time and automatically blocks threats before they reach your systems.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.