SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your company uses Microsoft Sentinel to manage security incidents. You need to automatically assign incidents to a specific analyst team based on the incident category (e.g., phishing incidents to the SOC team). What should you configure?
⚠ Common exam trap
The trap here is that candidates often overcomplicate the solution by choosing a playbook (Option D) because they think automation rules cannot handle assignment, but Sentinel automation rules natively support the 'Assign incident' action without needing Logic Apps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automation rule with a condition on incident category and an action to assign to the SOC team
Automation rules in Microsoft Sentinel allow you to define conditions based on incident properties (like category) and automatically take actions such as assigning the incident to a specific team. This is the correct and most efficient method for routing incidents by category without requiring custom code or external playbooks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a watchlist mapping categories to teams and use it in analytics rules
Why it's wrong here
Watchlists in Microsoft Sentinel serve as lookup tables to enrich incident data or provide context during investigation. While you could create a watchlist mapping categories to teams, analytics rules themselves are designed to detect threats and generate incidents, not to perform post-creation incident management actions like assigning an owner based on a watchlist lookup. The output of an analytics rule is an incident, not an assignment action.
- ✓
Automation rule with a condition on incident category and an action to assign to the SOC team
Why this is correct
Automation rules are the primary mechanism in Microsoft Sentinel for automatically managing incidents upon creation or update. By configuring an automation rule with a condition that matches the incident's category, it can directly execute an action to assign the incident to a specific owner or team, such as the SOC team, without requiring additional components or manual intervention. This provides an efficient and immediate way to route incidents.
- ✗
Configure the analytics rule to set the incident owner in the rule query
Why it's wrong here
Analytics rules are responsible for detecting suspicious activity within ingested data and creating incidents based on defined queries and logic. Their function is to identify threats and define the initial properties of an incident, such as its title, severity, and associated entities. However, analytics rules do not possess the functionality to perform incident management actions like setting an incident owner directly within the rule query or upon incident creation.
- ✗
Playbook triggered by incident creation that assigns the incident
Why it's wrong here
A playbook triggered by incident creation can assign incidents, but it requires a separate automation rule to invoke it, adding unnecessary latency and complexity. The correct solution uses an automation rule directly with a custom incident property to assign ownership without a playbook. This option tempts because playbooks are commonly used for response actions like assignment, and would be correct if the scenario required complex logic or external system integration beyond simple property-based routing.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Sentinel
Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration automation and response (SOAR) service that helps organizations detect, investigate, and respond to cyber threats across their entire digital estate.
Key term
SOC
A Security Operations Center (SOC) is a centralized team that monitors, detects, analyzes, and responds to cybersecurity incidents to protect an organization's information systems.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.