SC-200 · Question #372
Your on-premises network contains two Active Directory Domain Services (AD DS) domains named contoso.com and fabrikam.com. Contoso.com contains a group named Group1. Fabrikam.com contains a group…
The correct answer is D. two automation rules assigned to Rule1. To automatically assign incidents from two different domains to two specific groups with minimal administrative effort, two automation rules linked to the incident creation are required.
Question
Your on-premises network contains two Active Directory Domain Services (AD DS) domains named contoso.com and fabrikam.com. Contoso.com contains a group named Group1. Fabrikam.com contains a group named Group2. You have a Microsoft Sentinel workspace named WS1 that contains a scheduled query rule named Rule1. Rule1 generates alerts in response to anomalous AD DS security events. Each alert creates an incident. You need to implement an incident triage solution that meets the following requirements:
- Security incidents from contoso.com must be assigned to Group1.
- Security incidents from fabrikam.com must be assigned to Group2.
- Administrative effort must be minimized.
What should you include in the solution?
Options
- Aa playbook that is triggered by the creation of an incident
- Ba playbook that is triggered by the creation of an alert
- Cone automation rule assigned to Rule1
- Dtwo automation rules assigned to Rule1
How the community answered
(31 responses)- A10% (3)
- B3% (1)
- C6% (2)
- D81% (25)
Why each option
To automatically assign incidents from two different domains to two specific groups with minimal administrative effort, two automation rules linked to the incident creation are required.
A playbook triggered by incident creation could assign incidents, but it would require more complex logic within a single playbook or multiple playbooks, potentially increasing administrative effort compared to simple automation rules for assignment.
A playbook triggered by alert creation would run before an incident is generated, making it less suitable for direct incident assignment actions.
One automation rule cannot fulfill both distinct assignment requirements for incidents originating from two separate domains with different target groups.
Automation rules in Microsoft Sentinel are used to automatically perform actions on incidents, such as assigning ownership or changing status, based on specific conditions. Since there are two distinct conditions (incidents from contoso.com and fabrikam.com) requiring two different assignments (Group1 and Group2), two separate automation rules are needed to handle each case specifically and minimize administrative effort.
Concept tested: Microsoft Sentinel automation rules for incident assignment
Source: https://learn.microsoft.com/en-us/azure/sentinel/create-manage-automation-rules
Community Discussion
No community discussion yet for this question.