Exam SC-500 Topic 1 Question 21 Discussion
Actual exam question for Microsoft's SC-500 exam
Question #: 21
Topic #: 1
Question #: 21
Topic #: 1
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft Sentinel workspace.
You have a multi-tier Security Operations Center (SOC) team.
You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts group and flagged for triage.
Solution: You create a playbook.
Does this meet the goal?
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft Sentinel workspace.
You have a multi-tier Security Operations Center (SOC) team.
You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts group and flagged for triage.
Solution: You create a playbook.
Does this meet the goal?
Suggested Answer: B Vote an answer
Creating a playbook alone does not ensure that it runs for every newly created incident. A playbook must be invoked by an automation rule or another supported trigger. An automation rule can immediately assign new incidents to the Tier 1 analysts group and apply a triage tag without requiring a playbook.
Reference:
https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules?tabs=onboarded
https://learn.microsoft.com/en-us/azure/sentinel/automation/automation
Reference:
https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules?tabs=onboarded
https://learn.microsoft.com/en-us/azure/sentinel/automation/automation
by Jacob at Oct 01, 2026, 06:29 PM
Contact Us
If you have any question please leave me your email address, we will reply and send email to you in 12 hours.
Our Working Time: ( GMT 0:00-15:00 ) From Monday to Saturday
Support: Contact now
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).