SC-200 Certification Practice Question #212

Question

You have an Azure subscription that uses Microsoft Sentinel.

You need to minimize the administrative effort required to respond to the incidents and remediate the security threats detected by Microsoft Sentinel.

Which two features should you use? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Accepted Answer

The requirement is to minimize administrative effort to both respond to incidents and remediate threats — the textbook Microsoft Sentinel SOAR pairing. **Automation rules** (C) centrally orchestrate incident handling (triage, assign, tag, change status) and, crucially, trigger playbooks across many analytics rules at once with minimal manual effort. **Playbooks** (D), built on Azure Logic Apps, are the collection of response/remediation actions (block IP, disable account, isolate VM) that actually perform the remediation. MS Learn pairs these two explicitly as the SOAR response stack. The official Suggested Answer of just D is incomplete for a two-answer question; the community Most Voted CD (7 votes, plus Krayzr 4 👍 and MadLads 3 👍) and MS Learn both confirm the full pair. Workbooks (A), Azure Automation runbooks (B), and Functions apps (E) are not the native Sentinel incident-response features. Confidence is high (92%) given MS Learn, Most Voted, and the partial Suggested Answer all converge on C and D.

More SC-200 practice questions