Exam SC-200 topic 3 question 44 discussion

D is correct

Based on the wording of the question, I think we can assume that there are already Azure AD alerts being generated in Sentinel. So you don't need an Analytic rule. You can just go create an automation rule for those specific alerts

Rule first, automation next C is the correct answer

D. an automation rule: You can't create an automation rule without first having an analytics rule to trigger it.

The correct answer is Automation Rules. Since the alert has already been generated by Microsoft Sentinel, the next step is to set up automation that triggers the Logic App in response to this alert. Analytics Rules are designed to detect threats and anomalies in the data collected by Sentinel and are responsible for generating alerts. The key part of the question is, "when Microsoft Sentinel detects an Azure AD-generated alert," which means the alert is already in place. Therefore, the task at hand is to use an automation rule to trigger the Logic App based on that alert.

I think C is the correct answer

Automation rules are not used to run logic apps, logic apps are run by playbooks. Perform basic automation tasks for incident handling: https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules?tabs=onboarded#what-are-automation-rules

wouldn't we have to create an analytic rule that triggers the alert and the automation? it only says that the connector is enabled...

Option Correct

D is correct

To ensure that app1 launches when Microsoft Sentinel detects an Azure AD-generated alert, you should create an automation rule first.