SC-200 Certification Practice Question #261

Question

You need to remediate active attacks to meet the technical requirements.
What should you include in the solution?

Accepted Answer

Remediating active attacks rapidly in Microsoft Sentinel is done with playbooks, and Sentinel playbooks are built on Azure Logic Apps — confirmed directly by MS Learn ("Playbooks in Microsoft Sentinel are based on workflows built in Azure Logic Apps … run a series of automated remediation actions to counter the threat"). The strongest community signals echo the mnemonic Logic Apps = Playbooks = automated remediation (Eltooth 21 👍, AlaReAla 7 👍, Ramye 7 👍). The minority view for D (livestreams) is reasonable on the word "active" but is rebutted in-thread: livestreams provide real-time monitoring and investigation launch, not automated remediation actions. With Suggested Answer, Most Voted, the top Highly Voted comments, and MS Learn all aligned on B, confidence is high despite the small absolute vote count.

More SC-200 practice questions