Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.

```kql
SecurityAlerts
| where Timestamp > ago(7d)
| where AlertName has "ransomware"
| summarize Count=count() by AlertSeverity
| order by Count desc
```

Refer to the exhibit. You run a KQL query in Microsoft Sentinel to investigate ransomware alerts. The query returns: AlertSeverity High: 5, Medium: 3, Low: 2. The security team wants to automate a response for all high-severity ransomware alerts. What should you configure?

⚠ Common exam trap

Microsoft Sentinel components are often tested: analytics rules for detection, hunting queries for investigation, workbooks for visualization, and automation rules for automated response. Candidates commonly confuse the purpose of each, especially automation rules versus analytics rules.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create an automation rule that triggers a playbook for high-severity ransomware incidents

Microsoft Sentinel automation rules allow you to define automated responses triggered when incidents are created or updated. By configuring an automation rule with a condition that checks for 'AlertSeverity' equal to 'High' and 'Ransomware' as the related alert, you can invoke a playbook to automatically respond to high-severity ransomware incidents, such as isolating affected machines or blocking indicators of compromise.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create an analytics rule for ransomware
Why it's wrong here
Analytics rules in Microsoft Sentinel are primarily designed to detect threats and generate security incidents and alerts based on scheduled queries or near real-time data streams. While essential for identifying ransomware activity, their function is limited to detection and notification. They do not inherently provide mechanisms to automate response actions or trigger remediation playbooks directly upon alert generation, making them unsuitable for orchestrating an automated response.
✗
Create a hunting query for ransomware
Why it's wrong here
A hunting query in Microsoft Sentinel is a KQL query used by security analysts for proactive, manual threat hunting and investigation across ingested logs. This process involves interactively searching for indicators of compromise or suspicious patterns that might have bypassed automated detections. Hunting is an investigative activity focused on discovery and understanding, not on automatically executing predefined response actions or playbooks when a threat is identified.
✗
Create a workbook to display ransomware alerts
Why it's wrong here
Microsoft Sentinel workbooks serve as flexible dashboards for visualizing and monitoring security data, including alerts, incidents, and logs from various sources. They enable security teams to create custom reports and gain insights into the security posture and threat landscape, such as ransomware activity. However, workbooks are purely a presentation and analysis tool; they do not possess any functionality to trigger automated responses or execute remediation workflows.
✓
Create an automation rule that triggers a playbook for high-severity ransomware incidents
Why this is correct
Automation rules in Microsoft Sentinel are specifically engineered to manage and respond to incidents automatically, serving as the orchestrator for automated actions. By configuring an automation rule to trigger a specific playbook (an Azure Logic App) when a high-severity ransomware incident is created, organizations can execute predefined, automated response steps. This capability is central to Security Orchestration, Automation, and Response (SOAR), ensuring rapid and consistent handling of critical threats.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question