SC-200 Certification Practice Question #104

Question

You have a playbook in Azure Sentinel.
When you trigger the playbook, it sends an email to a distribution group.
You need to modify the playbook to send the email to the owner of the resource instead of the distribution group.
What should you do?

Accepted Answer

A Sentinel playbook is an Azure Logic App whose **trigger** fires the workflow and whose **action** (Office 365 Outlook "Send an email") sets the recipient. To redirect mail from a distribution group to the resource owner you evaluate the owner with a **Condition** (a Logic Apps Control action) and then update the email **action** to target that owner — exactly option C. The trigger determines *when* the playbook runs, not *who* gets the email, so option A's "modify the trigger" is the wrong lever; option B adds an unneeded data source; option D wrongly assumes a playbook contains alerts. The official suggested answer, the dominant 25-vote community pick, and a hands-on lab confirmation all point to C. Confidence is held at 80% because there is a genuine, well-argued minority (A) that conflates the parameter/trigger pattern with changing the recipient — but MS Learn places recipient changes in the action, breaking the tie toward C.

More SC-200 practice questions