SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization uses Microsoft Sentinel for security operations. You need to ensure that when a high-severity incident is created, a Microsoft Teams message is sent to the SOC team automatically. What should you configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an automation rule that triggers on incident creation and runs a playbook.
Automation rules in Microsoft Sentinel allow you to define triggers (e.g., incident creation) and run a playbook as an action. A playbook can contain steps to send a Teams message. So you create an automation rule that triggers on incident creation and runs a playbook. Option B is incorrect because attaching a playbook to an analytics rule is not the standard method; analytics rules create incidents, but automation rules handle the automated response. Option C is incorrect because analytics rules do not have a direct 'automated response' for sending notifications. Option D is incorrect because workbooks are used for data visualization and dashboards, not for automation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an automation rule that triggers on incident creation and runs a playbook.
Why this is correct
Automation rules in Microsoft Sentinel are specifically designed to orchestrate responses to security incidents. By configuring an automation rule to trigger upon incident creation, it can then execute a pre-defined playbook (an Azure Logic App). This playbook can contain various actions, such as sending a notification to a Microsoft Teams channel, thereby automating the initial communication and response for new incidents.
- ✗
Create a playbook and attach it to an analytics rule.
Why it's wrong here
Attaching a playbook directly to an analytics rule causes the playbook to trigger when an *alert* is generated by that specific rule, not when an *incident* is created. Incidents in Sentinel often aggregate multiple alerts, meaning triggering on alert creation could lead to redundant or premature notifications if multiple alerts contribute to a single, evolving incident.
- ✗
Modify the analytics rule to include an automated response.
Why it's wrong here
Analytics rules in Microsoft Sentinel are primarily responsible for detecting threats and generating alerts and incidents based on defined queries and conditions. While they are fundamental for detection, they do not possess built-in capabilities to directly execute complex automated responses like sending messages to Microsoft Teams. Such advanced automation requires integration with playbooks, typically orchestrated via automation rules.
- ✗
Configure a workbook to send email alerts.
Why it's wrong here
Microsoft Sentinel workbooks are interactive dashboards used for data visualization, exploration, and monitoring of security data. Their primary purpose is to provide insights and present information in a graphical format, not to perform active security operations or send automated notifications such as email alerts. For automated alerting, other Sentinel features like analytics rules and playbooks are required.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.