SC-100 Certification Practice Question #101

Question

You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1.

You need to configure WS1 to meet the following requirements:

•	Create custom dashboards to visualize the workload of security analysts that use Microsoft Sentinel.
•	Enable automated responses for the security alerts generated by Microsoft Sentinel analytics rules.

What should you use for each requirement? To answer, select the options in the answer area.

NOTE: Each correct answer is worth one point.

Accepted Answer

Workbooks are Microsoft Sentinel's interactive visualization/dashboard component, so they map to "create custom dashboards to visualize the workload of security analysts." Playbooks are Sentinel's SOAR automation (Logic Apps) triggered by alerts/incidents from analytics rules, so they map to "enable automated responses for the security alerts." Notebooks are the distractor (Jupyter-based data analysis/hunting) and fit neither requirement. The community is unanimous (5 👍 Highly Voted plus a Most Recent confirmation) and both MS Learn citations directly back each mapping, supporting high confidence.

More SC-100 practice questions