SC-200 Certification Practice Question #178

Question

You have a Microsoft Sentinel workspace.

You need to create playbooks that meet the following requirements:

•	Use an automation rule to trigger actions on an entity.
•	Call the Entities - Get Hosts action.

Which types of playbooks should you use, and which parameters should you specify? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The requirement is explicitly "use an automation rule to trigger actions on an entity." Per MS Learn, automation rules can only run playbooks that start with the **incident trigger** — alert-trigger and entity-trigger playbooks cannot be called by automation rules. The incident trigger delivers the full incident object, including the **Entities** array, which is exactly what the **Entities - Get Hosts** action consumes (the action filters the Entities array for Host objects). Among the parameter options, only **FullIncidentProperties only** passes the complete incident context (including Entities) required for that action. The lone Highly Voted comment (10 👍) reaches the same conclusion. Confidence is held at 88 (not higher) because the scraped file has no recorded Suggested/Most Voted letters, so the ratification rests on a single high-vote comment plus strong MS Learn grounding.

More SC-200 practice questions