Your on-premises network contains two Active Directory Domain Services (AD DS) domains named contoso.

According to Microsoft Sentinel documentation, automation rules are used to automatically assign, tag, or close incidents as soon as they are created. Automation rules can filter incidents based on attributes such as alert name, severity, or source , and then perform specific actions like assigning incidents to users or groups .

In this scenario, incidents are generated by Rule1 from two different AD DS domains — contoso.com and fabrikam.com — and each must be routed to a specific security group for triage. The most efficient approach is to create two automation rules , each filtering incidents by domain (one for contoso.com and on e for fabrikam.com) and automatically assigning them to Group1 and Group2 respectively. This approach minimizes administrative overhead because automation rules are easy to maintain and don’t require the complexity of a playbook.

A playbook (Logic App) cou ld technically achieve the same outcome, but it introduces more administrative management, permissions, and maintenance. Hence, per Microsoft Sentinel best practices, multiple automation rules provide a lightweight and direct automation layer for incident assignment.

✅ Correct Answer: C. two automation rules assigned to Rule1