SC-200 Certification Practice Question #106

Question

You have an Azure Sentinel workspace.
You need to test a playbook manually in the Azure portal.
From where can you run the test in Azure Sentinel?

Accepted Answer

Both the Suggested Answer and an overwhelming Most Voted (25) select D, and MS Learn's "Run a playbook manually, on demand" procedure begins on the Incidents page (select incident > Actions > Run playbook), which Ramye corroborates against the official Microsoft SC-200 practice assessment. There is a genuine, well-argued minority for A (Playbooks), since the Playbooks blade exposes a per-playbook Run button; however, manually running a playbook there still operates in the context of a selected incident/alert/entity to supply the required trigger parameters (the 7c0a comment notes the Sentinel trigger provides the entity array). Microsoft's keyed answer and documented entry point is Incidents, so D wins. Confidence is held just below 90 because of the credible A faction.

More SC-200 practice questions