Exam SC-200 topic 3 question 64 discussion

Creating a logic app before creating the automation rule that triggers said logic app is ... logically the correct answer.

The answer is B. You can create a Playbook in the automation blade of Sentinel. Also, when you are creating the playbook, as part of the process you will create a logic app. You do NOT need to create an automation rule for creating a playbook. The playbooks can run independent of the automation rule as well.

First create the conditions to trigger the playbook so the selected answer of C should be the correct one. An automation rule is the first thing to create when needing to create a playbook, the automation rule will determine the conditions to be met before the playbook is triggered. Logic Apps is then used to configure the behavior of the playbook only after it has been triggered.

Confirmed by SC-200 Microsoft Practice Assessment https://learn.microsoft.com/en-us/credentials/certifications/exams/sc-200/practice/assessment?assessment-type=practice&assessmentId=59

All of comments are wrong First thing is creating the flow which will trigger the playbook https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks?ssp=1&darkschemeovr=1&setlang=en&cc=EG&safesearch=moderate#steps-for-creating-a-playbook

Correct Option B

Playbooks in Azure Sentinel are created using Logic Apps. To create a new Logic App, click on "Playbooks" in the left-hand menu under "Configuration." Click the "+ Add" button to create a new playbook.

B. an Azure logic app

i'd say from these answers, i think 'logic app' hunting query makes no sense, automation rule is dependent of a existing logic app, azure functions doesn't make sense.

Logic Apps are a dependency for creating a playbook

B is correct

Azure logic apps are a workflow automation platform that provides a visual designer to model and automate processes as a series of steps or actions. Logic apps can be triggered by events, such as an alert in Microsoft Sentinel, and can perform a variety of actions, such as sending an email or creating a work item in Azure DevOps.

First step in creating a new play book is Select Automation, select Create. https://learn.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook?tabs=LAC%2Cincidents