SC-100 Certification Practice Question #6

Question

Your company is moving all on-premises workloads to Azure and Microsoft 365.
You need to design a security orchestration, automation, and response (SOAR) strategy in Microsoft Sentinel that meets the following requirements:
✑ Minimizes manual intervention by security operation analysts
✑ Supports triaging alerts within Microsoft Teams channels
What should you include in the strategy?

Accepted Answer

The requirement is a SOAR strategy that minimizes manual analyst intervention and triages alerts within Microsoft Teams channels. In Microsoft Sentinel, SOAR is delivered through playbooks (Azure Logic Apps workflows), which automate response and include out-of-the-box actions for posting/triaging incidents in Microsoft Teams channels. The Suggested Answer, a dominant 19-vote Most Voted, two Highly Voted comments, and MS Learn all agree. The minority "data connectors" votes (1 👍 each) are discounted because connectors only ingest data and provide no automation or Teams triage. KQL and workbooks are likewise eliminated as they address querying and visualization, not automated response.

More SC-100 practice questions