Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.
```json
{
  "properties": {
    "displayName": "High Severity Alert Playbook",
    "trigger": {
      "type": "Microsoft.SecurityInsights/AlertRule",
      "conditions": [
        {
          "conditionType": "PropertyCondition",
          "property": "Severity",
          "operator": "Equals",
          "value": "High"
        }
      ]
    },
    "actions": [
      {
        "type": "Microsoft.SecurityInsights/AlertRule/Incident",
        "order": 1,
        "logicAppResourceId": "/subscriptions/.../resourceGroups/.../providers/Microsoft.Logic/workflows/IncidentCreationWorkflow",
        "triggerUri": "https://..."
      }
    ]
  }
}```

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. The JSON snippet shows a rule designed to create an incident when a high-severity alert is generated. However, the rule is not triggering. What is the most likely reason?

⚠ Common exam trap

A common mix-up: candidates assume automation rules can freely create incidents from any trigger type, but Microsoft Sentinel strictly limits incident creation to analytics rule configurations or incident-scoped automation rules, not alert-scoped automation rules.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Automation rules triggered on alert creation cannot create incidents; they can only run playbooks.

Automation rules in Microsoft Sentinel that are triggered on alert creation (i.e., when an alert is generated) are designed only to run playbooks (automated response actions), not to create incidents. Incident creation from alerts is handled automatically by Sentinel's built-in analytics rules or by the incident creation rule type, not by an automation rule triggered on alert creation. The JSON snippet shows a trigger type of 'Microsoft.SecurityInsights/AlertRule/Alert', which confirms the rule fires on alert creation, and the action attempts to create an incident, which is not supported for this trigger type.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The logicAppResourceId is missing a required parameter.
Why it's wrong here
The `logicAppResourceId` parameter typically expects a fully qualified Azure Resource ID string, such as `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Logic/workflows/{logicAppName}`. This string inherently contains all necessary identifiers and does not require additional, separate parameters to be considered complete or valid. Therefore, the assertion that it is missing a required parameter is incorrect, as the resource ID itself is the complete parameter for identifying the Logic App.
✗
The action should be of type 'Microsoft.SecurityInsights/AlertRule/Alert' instead.
Why it's wrong here
The action type 'Microsoft.SecurityInsights/AlertRule/Alert' is not a recognized or valid action within Azure Sentinel automation rules. Automation rules support specific action types like `runPlaybook`, `createIncident`, `updateIncident`, or `changeStatus` to manage security operations. Attempting to use a non-existent action type would result in a configuration error, as the platform does not define such an operation for automation rule execution.
✓
Automation rules triggered on alert creation cannot create incidents; they can only run playbooks.
Why this is correct
Automation rules configured to trigger upon the creation of an alert have a specific limitation regarding their direct actions. While they can successfully execute a playbook, which in turn can create an incident, the automation rule itself cannot directly perform a 'createIncident' action. This distinction is crucial for understanding the flow of operations, as direct incident creation is typically reserved for rules triggered by incident-related events.
✗
The trigger type is incorrect; it should be 'Microsoft.SecurityInsights/Incident'.
Why it's wrong here
The trigger type 'Microsoft.SecurityInsights/AlertRule/Alert' (or similar for alert creation) is indeed a valid and common trigger for Azure Sentinel automation rules, indicating the rule should activate when a new security alert is generated. However, the issue lies not with the trigger itself, but with the subsequent action attempting to directly create an incident. While the trigger is correct for alerts, the specific action of direct incident creation is not permitted for alert-triggered automation rules.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question