Exam SC-200 topic 7 question 24 discussion

ChatGTP: ✅ Correct answer: D. Two automation rules assigned to Rule1 💡 Explanation: To assign incidents to different groups based on the originating domain (contoso.com or fabrikam.com) with minimal administrative effort, the best approach is to: Create two automation rules, each with a condition to check for indicators (like hostname, domain, or event source). Use the rules to automatically assign incidents to Group1 or Group2. ✅ Why two automation rules (Option D) is correct: Automation rules in Microsoft Sentinel can act on incident properties such as title, custom details, or mapped entities. Each domain (contoso.com / fabrikam.com) would likely be identifiable via a field in the alert/incident (e.g., domain name, hostname suffix). Creating one rule per domain ensures precise and maintainable logic, with clear ownership per domain. Requires less overhead than scripting or maintaining complex playbooks.