Exam SC-200 topic 3 question 22 discussion

Playbooks are collections of procedures that can be run from Azure Sentinel in response to an alert or incident. A playbook can help automate and orchestrate your response, and can be set to run automatically when specific alerts or incidents are generated, by being attached to an analytics rule or an automation rule, respectively. It can also be run manually on-demand. Playbooks in Azure Sentinel are based on workflows built in Azure Logic Apps, which means that you get all the power, customizability, and built-in templates of Logic Apps. Thus correct answer

Correct

It should be B,C

It is worded poorly to say you need to associate the playbook with the incident instead of setting the incident as a trigger, but options C, D and E make even less sense.

A. Add a playbook B. Associate a playbook to an incident To send a Microsoft Teams message to a channel whenever a sign-in from a suspicious IP address is detected in Azure Sentinel, you will need to perform two actions: Add a playbook: A playbook is a set of actions that can be triggered in response to an incident, such as sending a message to a channel in Microsoft Teams. To add a playbook, you will need to navigate to the Playbooks tab in Azure Sentinel and create a new playbook that includes an action to send a message to a Microsoft Teams channel. Associate a playbook to an incident: After creating the playbook, you will need to associate it with an incident in Azure Sentinel. This can be done by navigating to the Incidents tab in Azure Sentinel and selecting the incident that you want to associate the playbook with. Then, select the "Associate Playbook" button and select the playbook that you created.

Correct answer A&B

AB IMHO.

A & B is correct

For me B is a wrong choice. We can NOT associate a playbook to an incident! We can: - trigger playbook when incident happens - associate playbook to an ANALYTIC RULE Fusion rule is important to catch Multistage attacks not suspicious sign-in. So A - ok B - weird.

Correct - A & B

i agree with the answer

Correct