Practice Exams:

View All

Microsoft SC-200 Microsoft Sentinel Automation Rules And Playbooks Practice Test

Skills 1.1 • 30 original questions

This Microsoft SC-200 Security Operations Analyst practice test focuses on microsoft sentinel automation rules and playbooks through original scenario-based questions aligned to the skills measured as of July 28, 2026. Use the full ExamSnap SC-200 collection for broader practice across the current Defender XDR, Microsoft Sentinel, incident-response, and threat-hunting skill areas. For broader exam preparation, review the Microsoft SC-200 Exam Dumps page.

Instructions: Select the best answer for each question. Review the explanation after answering; each distractor includes a reason it is not the best choice for that scenario.

Question 1

During a SOC tuning initiative at Adventure Works, the threat hunter must automatically apply the specified incident-management action when a Sentinel incident matches defined conditions. Which action most directly satisfies the requirement for the Americas SOC, response wave 1? The design priority is to minimize manual analyst steps.

Configure the appropriate email notification rule in Microsoft Defender XDR
Configure the automated investigation and response capability and its remediation behavior in Microsoft Defender XDR
Configure Defender for Endpoint device groups with the required permissions and automation level
Deploy the required endpoint security policy, including the appropriate attack surface reduction rule configuration
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Correct answer: E

Why: Sentinel automation rules evaluate incidents and can automatically update, assign, tag, close, or trigger response workflows when their conditions are met. This directly addresses the requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

Option review:

A: Defender XDR notification settings can send email for supported incident, action, and threat-analytics events so analysts receive the requested operational signal. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

B: Automated investigation and response can investigate supported alerts and take or recommend remediation actions, reducing manual triage for eligible incidents. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

C: Device groups provide scope for endpoint access and automation settings, allowing organizations to separate administration and remediation behavior for different device populations. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

D: Endpoint security policy and ASR rules reduce attack surface on managed endpoints and are the direct control for blocking or auditing the targeted risky behavior. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

E: Sentinel automation rules evaluate incidents and can automatically update, assign, tag, close, or trigger response workflows when their conditions are met. This directly addresses the requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

Learning point: Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Question 2

Proseware Services is revising its SOC runbook after a security automation project. Analysts need to orchestrate a multi-step automated response or external integration from Microsoft Sentinel. Which implementation should the SOC analyst select for the high-value-assets group, response wave 1 while trying to retain evidence for follow-up analysis?

Configure the automated investigation and response capability and its remediation behavior in Microsoft Defender XDR
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Configure the relevant Microsoft Defender for Endpoint rule setting for the endpoint behavior being managed
Configure the appropriate email notification rule in Microsoft Defender XDR

Correct answer: B

Why: Sentinel playbooks use Logic Apps to orchestrate repeatable response steps and integrations that go beyond simple incident-field automation. This directly addresses the requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Option review:

A: Automated investigation and response can investigate supported alerts and take or recommend remediation actions, reducing manual triage for eligible incidents. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

B: Sentinel playbooks use Logic Apps to orchestrate repeatable response steps and integrations that go beyond simple incident-field automation. This directly addresses the requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

C: Sentinel automation rules evaluate incidents and can automatically update, assign, tag, close, or trigger response workflows when their conditions are met. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

D: Defender for Endpoint rule settings govern endpoint-side detection and response behavior and should be adjusted at the endpoint service layer rather than by changing unrelated Sentinel analytics. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

E: Defender XDR notification settings can send email for supported incident, action, and threat-analytics events so analysts receive the requested operational signal. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Learning point: Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Question 3

A ticket escalated to the Tier 2 analyst at Wide World Importers states one non-negotiable goal: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions. Which choice is the strongest fit for the server fleet, response wave 2? The team also wants to retain evidence for follow-up analysis.

Deploy the required endpoint security policy, including the appropriate attack surface reduction rule configuration
Configure Defender for Endpoint device groups with the required permissions and automation level
Configure the appropriate email notification rule in Microsoft Defender XDR
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Correct answer: D

Option review:

A: Endpoint security policy and ASR rules reduce attack surface on managed endpoints and are the direct control for blocking or auditing the targeted risky behavior. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

B: Device groups provide scope for endpoint access and automation settings, allowing organizations to separate administration and remediation behavior for different device populations. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

C: Defender XDR notification settings can send email for supported incident, action, and threat-analytics events so analysts receive the requested operational signal. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

D: Sentinel automation rules evaluate incidents and can automatically update, assign, tag, close, or trigger response workflows when their conditions are met. This directly addresses the requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

E: Sentinel playbooks use Logic Apps to orchestrate repeatable response steps and integrations that go beyond simple incident-field automation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

Learning point: Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Question 4

For the remote-user fleet, response wave 2 at Wingtip Toys, a multi-cloud monitoring rollout can proceed only if the team can orchestrate a multi-step automated response or external integration from Microsoft Sentinel. What should the threat hunter configure first if the operational goal is to avoid unnecessary alert noise?

Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Configure the automated investigation and response capability and its remediation behavior in Microsoft Defender XDR
Configure Microsoft Defender for Endpoint custom data collection for the endpoint data required by the investigation
Deploy the required endpoint security policy, including the appropriate attack surface reduction rule configuration
Configure the appropriate email notification rule in Microsoft Defender XDR

Correct answer: A

Option review:

A: Sentinel playbooks use Logic Apps to orchestrate repeatable response steps and integrations that go beyond simple incident-field automation. This directly addresses the requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

B: Automated investigation and response can investigate supported alerts and take or recommend remediation actions, reducing manual triage for eligible incidents. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

C: Custom data collection extends the endpoint telemetry available to the security team for scenarios that require data beyond the default collection set. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

D: Endpoint security policy and ASR rules reduce attack surface on managed endpoints and are the direct control for blocking or auditing the targeted risky behavior. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Learning point: Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Question 5

The security architecture review at Northwind Traders focuses on this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions. Which Microsoft security action is most appropriate for the research subscription, response wave 3, given the need to avoid unnecessary alert noise?

Deploy the required endpoint security policy, including the appropriate attack surface reduction rule configuration
Tune the Defender XDR alert behavior, including suppression or correlation settings, for the identified signal
Enable and validate automatic attack disruption in Microsoft Defender XDR for eligible attacks
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Configure the relevant Microsoft Defender for Endpoint rule setting for the endpoint behavior being managed

Correct answer: D

Option review:

B: Defender XDR alert tuning is used to reduce unwanted alerts and improve how related security signals are surfaced and correlated for investigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

C: Automatic attack disruption uses correlated XDR signals to contain eligible active attacks across affected identities and devices while the investigation continues. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

E: Defender for Endpoint rule settings govern endpoint-side detection and response behavior and should be adjusted at the endpoint service layer rather than by changing unrelated Sentinel analytics. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

Learning point: Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Question 6

A change advisory board at Tailspin Toys asks how to orchestrate a multi-step automated response or external integration from Microsoft Sentinel during a endpoint containment exercise. Which proposed action should the Tier 2 analyst approve for the regulated workload segment, response wave 3? The change should preserve least privilege.

Configure Defender for Endpoint device groups with the required permissions and automation level
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Enable or configure the required Microsoft Defender for Endpoint advanced feature in the Defender portal
Tune the Defender XDR alert behavior, including suppression or correlation settings, for the identified signal
Configure the relevant Microsoft Defender for Endpoint rule setting for the endpoint behavior being managed

Correct answer: B

Option review:

A: Device groups provide scope for endpoint access and automation settings, allowing organizations to separate administration and remediation behavior for different device populations. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

C: Defender for Endpoint advanced features control optional endpoint capabilities and should be enabled when the requested investigation or protection capability depends on them. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

D: Defender XDR alert tuning is used to reduce unwanted alerts and improve how related security signals are surfaced and correlated for investigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

E: Defender for Endpoint rule settings govern endpoint-side detection and response behavior and should be adjusted at the endpoint service layer rather than by changing unrelated Sentinel analytics. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Learning point: Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Question 7

Blue Yonder Airlines has ruled out a manual one-off workaround. For the Tier 2 queue, response wave 4, the remaining requirement is to automatically apply the specified incident-management action when a Sentinel incident matches defined conditions. Which choice best addresses it and helps preserve least privilege?

Enable and validate automatic attack disruption in Microsoft Defender XDR for eligible attacks
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Tune the Defender XDR alert behavior, including suppression or correlation settings, for the identified signal
Configure the relevant Microsoft Defender for Endpoint rule setting for the endpoint behavior being managed
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Correct answer: E

Option review:

A: Automatic attack disruption uses correlated XDR signals to contain eligible active attacks across affected identities and devices while the investigation continues. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

B: Sentinel playbooks use Logic Apps to orchestrate repeatable response steps and integrations that go beyond simple incident-field automation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

C: Defender XDR alert tuning is used to reduce unwanted alerts and improve how related security signals are surfaced and correlated for investigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

D: Defender for Endpoint rule settings govern endpoint-side detection and response behavior and should be adjusted at the endpoint service layer rather than by changing unrelated Sentinel analytics. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

Learning point: Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Question 8

During post-incident review at Trey Research, the security engineer identifies a gap: the SOC still needs to orchestrate a multi-step automated response or external integration from Microsoft Sentinel. Which action should be added for the identity-response team, response wave 4 before the next incident, with an emphasis on trying to reduce mean time to respond?

Configure the relevant Microsoft Defender for Endpoint rule setting for the endpoint behavior being managed
Enable and validate automatic attack disruption in Microsoft Defender XDR for eligible attacks
Configure the appropriate email notification rule in Microsoft Defender XDR
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Configure Microsoft Defender for Endpoint custom data collection for the endpoint data required by the investigation

Correct answer: D

Option review:

A: Defender for Endpoint rule settings govern endpoint-side detection and response behavior and should be adjusted at the endpoint service layer rather than by changing unrelated Sentinel analytics. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

B: Automatic attack disruption uses correlated XDR signals to contain eligible active attacks across affected identities and devices while the investigation continues. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

C: Defender XDR notification settings can send email for supported incident, action, and threat-analytics events so analysts receive the requested operational signal. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

D: Sentinel playbooks use Logic Apps to orchestrate repeatable response steps and integrations that go beyond simple incident-field automation. This directly addresses the requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

E: Custom data collection extends the endpoint telemetry available to the security team for scenarios that require data beyond the default collection set. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Learning point: Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Question 9

The security operations analyst at Contoso Health is comparing several Microsoft security options for a phishing investigation. Which one directly enables the team to automatically apply the specified incident-management action when a Sentinel incident matches defined conditions for the cloud-security team, response wave 5 while helping reduce mean time to respond?

Configure the relevant Microsoft Defender for Endpoint rule setting for the endpoint behavior being managed
Configure Defender for Endpoint device groups with the required permissions and automation level
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Enable and validate automatic attack disruption in Microsoft Defender XDR for eligible attacks
Configure Microsoft Defender for Endpoint custom data collection for the endpoint data required by the investigation

Correct answer: C

Option review:

A: Defender for Endpoint rule settings govern endpoint-side detection and response behavior and should be adjusted at the endpoint service layer rather than by changing unrelated Sentinel analytics. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

C: Sentinel automation rules evaluate incidents and can automatically update, assign, tag, close, or trigger response workflows when their conditions are met. This directly addresses the requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

D: Automatic attack disruption uses correlated XDR signals to contain eligible active attacks across affected identities and devices while the investigation continues. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

E: Custom data collection extends the endpoint telemetry available to the security team for scenarios that require data beyond the default collection set. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

Learning point: Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Question 10

A security-operations workshop at Litware Manufacturing defines the desired outcome as follows: orchestrate a multi-step automated response or external integration from Microsoft Sentinel. Which implementation should be chosen for the messaging-security team, response wave 5? The team wants to scope the change to the affected security domain.

Configure Microsoft Defender for Endpoint custom data collection for the endpoint data required by the investigation
Deploy the required endpoint security policy, including the appropriate attack surface reduction rule configuration
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Tune the Defender XDR alert behavior, including suppression or correlation settings, for the identified signal
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Correct answer: C

Option review:

A: Custom data collection extends the endpoint telemetry available to the security team for scenarios that require data beyond the default collection set. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

B: Endpoint security policy and ASR rules reduce attack surface on managed endpoints and are the direct control for blocking or auditing the targeted risky behavior. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

C: Sentinel playbooks use Logic Apps to orchestrate repeatable response steps and integrations that go beyond simple incident-field automation. This directly addresses the requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

E: Sentinel automation rules evaluate incidents and can automatically update, assign, tag, close, or trigger response workflows when their conditions are met. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Learning point: Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Question 11

Which Microsoft security action best matches this technical purpose for the EMEA SOC, response wave 6: Sentinel automation rules evaluate incidents and can automatically update, assign, tag, close, or trigger response workflows when their conditions are met. The SOC is trying to scope the change to the affected security domain.

Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Configure Microsoft Defender for Endpoint custom data collection for the endpoint data required by the investigation
Configure the automated investigation and response capability and its remediation behavior in Microsoft Defender XDR
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Enable and validate automatic attack disruption in Microsoft Defender XDR for eligible attacks

Correct answer: D

Option review:

A: Sentinel playbooks use Logic Apps to orchestrate repeatable response steps and integrations that go beyond simple incident-field automation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

B: Custom data collection extends the endpoint telemetry available to the security team for scenarios that require data beyond the default collection set. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

C: Automated investigation and response can investigate supported alerts and take or recommend remediation actions, reducing manual triage for eligible incidents. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

E: Automatic attack disruption uses correlated XDR signals to contain eligible active attacks across affected identities and devices while the investigation continues. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

Learning point: Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Question 12

An analyst at Fourth Coffee describes the needed capability this way: Sentinel playbooks use Logic Apps to orchestrate repeatable response steps and integrations that go beyond simple incident-field automation. Which option should be associated with that requirement for the Americas SOC, response wave 6 while the team tries to keep the workflow auditable?

Configure the relevant Microsoft Defender for Endpoint rule setting for the endpoint behavior being managed
Deploy the required endpoint security policy, including the appropriate attack surface reduction rule configuration
Configure the automated investigation and response capability and its remediation behavior in Microsoft Defender XDR
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Configure Microsoft Defender for Endpoint custom data collection for the endpoint data required by the investigation

Correct answer: D

Option review:

C: Automated investigation and response can investigate supported alerts and take or recommend remediation actions, reducing manual triage for eligible incidents. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Learning point: Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Question 13

During a design validation for the privileged-users group, response wave 7, Wingtip Toys documents the following behavior: Sentinel automation rules evaluate incidents and can automatically update, assign, tag, close, or trigger response workflows when their conditions are met. Which Microsoft security feature or action is being described? The objective is to keep the workflow auditable.

Enable or configure the required Microsoft Defender for Endpoint advanced feature in the Defender portal
Configure Defender for Endpoint device groups with the required permissions and automation level
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Configure the relevant Microsoft Defender for Endpoint rule setting for the endpoint behavior being managed
Configure the automated investigation and response capability and its remediation behavior in Microsoft Defender XDR

Correct answer: C

Option review:

A: Defender for Endpoint advanced features control optional endpoint capabilities and should be enabled when the requested investigation or protection capability depends on them. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

D: Defender for Endpoint rule settings govern endpoint-side detection and response behavior and should be adjusted at the endpoint service layer rather than by changing unrelated Sentinel analytics. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

E: Automated investigation and response can investigate supported alerts and take or recommend remediation actions, reducing manual triage for eligible incidents. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

Learning point: Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Question 14

The incident responder must identify the Microsoft security capability that provides this function for the server fleet, response wave 7: Sentinel playbooks use Logic Apps to orchestrate repeatable response steps and integrations that go beyond simple incident-field automation. Which choice is correct if the SOC also needs to avoid changing an unrelated control plane?

Enable or configure the required Microsoft Defender for Endpoint advanced feature in the Defender portal
Enable and validate automatic attack disruption in Microsoft Defender XDR for eligible attacks
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Configure the relevant Microsoft Defender for Endpoint rule setting for the endpoint behavior being managed
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Correct answer: C

Option review:

A: Defender for Endpoint advanced features control optional endpoint capabilities and should be enabled when the requested investigation or protection capability depends on them. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Learning point: Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Question 15

A runbook for the production subscription, response wave 8 contains this description: Sentinel automation rules evaluate incidents and can automatically update, assign, tag, close, or trigger response workflows when their conditions are met. Which implementation belongs in that runbook during a audit investigation? The process should avoid changing an unrelated control plane.

Configure the appropriate email notification rule in Microsoft Defender XDR
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Deploy the required endpoint security policy, including the appropriate attack surface reduction rule configuration
Configure Defender for Endpoint device groups with the required permissions and automation level
Configure Microsoft Defender for Endpoint custom data collection for the endpoint data required by the investigation

Correct answer: B

Option review:

B: Sentinel automation rules evaluate incidents and can automatically update, assign, tag, close, or trigger response workflows when their conditions are met. This directly addresses the requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

C: Endpoint security policy and ASR rules reduce attack surface on managed endpoints and are the direct control for blocking or auditing the targeted risky behavior. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

D: Device groups provide scope for endpoint access and automation settings, allowing organizations to separate administration and remediation behavior for different device populations. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

E: Custom data collection extends the endpoint telemetry available to the security team for scenarios that require data beyond the default collection set. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

Learning point: Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Question 16

Alpine Ski House is troubleshooting a SOC tuning initiative. Evidence shows that the decisive requirement is to orchestrate a multi-step automated response or external integration from Microsoft Sentinel. Which action should the Defender administrator investigate first for the research subscription, response wave 8, without losing the ability to improve detection coverage?

Configure Defender for Endpoint device groups with the required permissions and automation level
Configure the automated investigation and response capability and its remediation behavior in Microsoft Defender XDR
Configure Microsoft Defender for Endpoint custom data collection for the endpoint data required by the investigation
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Deploy the required endpoint security policy, including the appropriate attack surface reduction rule configuration

Correct answer: D

Option review:

B: Automated investigation and response can investigate supported alerts and take or recommend remediation actions, reducing manual triage for eligible incidents. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

E: Endpoint security policy and ASR rules reduce attack surface on managed endpoints and are the direct control for blocking or auditing the targeted risky behavior. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Learning point: Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Question 17

After eliminating network and licensing causes, the threat hunter at Trey Research determines that success depends on the ability to automatically apply the specified incident-management action when a Sentinel incident matches defined conditions. Which security action should be checked next for the Tier 1 queue, response wave 9? The team must improve detection coverage.

Enable or configure the required Microsoft Defender for Endpoint advanced feature in the Defender portal
Deploy the required endpoint security policy, including the appropriate attack surface reduction rule configuration
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Enable and validate automatic attack disruption in Microsoft Defender XDR for eligible attacks
Tune the Defender XDR alert behavior, including suppression or correlation settings, for the identified signal

Correct answer: C

Option review:

B: Endpoint security policy and ASR rules reduce attack surface on managed endpoints and are the direct control for blocking or auditing the targeted risky behavior. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

E: Defender XDR alert tuning is used to reduce unwanted alerts and improve how related security signals are surfaced and correlated for investigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

Learning point: Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Question 18

A service-desk escalation during a cloud-workload incident has been narrowed to one security-operations requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel. Which configuration is the most relevant starting point for the Tier 2 queue, response wave 9 if the SOC wants to support repeatable response?

Configure Microsoft Defender for Endpoint custom data collection for the endpoint data required by the investigation
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Enable or configure the required Microsoft Defender for Endpoint advanced feature in the Defender portal
Deploy the required endpoint security policy, including the appropriate attack surface reduction rule configuration

Correct answer: C

Option review:

B: Sentinel automation rules evaluate incidents and can automatically update, assign, tag, close, or trigger response workflows when their conditions are met. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

D: Defender for Endpoint advanced features control optional endpoint capabilities and should be enabled when the requested investigation or protection capability depends on them. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Learning point: Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Question 19

The failure pattern at Litware Manufacturing affects the endpoint-response team, response wave 10. Before making unrelated policy changes, the Tier 2 analyst needs a solution that will automatically apply the specified incident-management action when a Sentinel incident matches defined conditions. Which action is most directly relevant and helps support repeatable response?

Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Enable or configure the required Microsoft Defender for Endpoint advanced feature in the Defender portal
Configure the appropriate email notification rule in Microsoft Defender XDR
Tune the Defender XDR alert behavior, including suppression or correlation settings, for the identified signal

Correct answer: B

Option review:

C: Defender for Endpoint advanced features control optional endpoint capabilities and should be enabled when the requested investigation or protection capability depends on them. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

D: Defender XDR notification settings can send email for supported incident, action, and threat-analytics events so analysts receive the requested operational signal. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

Learning point: Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Question 20

While investigating a identity compromise review, Woodgrove Bank confirms the environment must orchestrate a multi-step automated response or external integration from Microsoft Sentinel. Which Microsoft security capability should be validated for the cloud-security team, response wave 10? The investigation should separate collection from detection logic.

Configure Defender for Endpoint device groups with the required permissions and automation level
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Deploy the required endpoint security policy, including the appropriate attack surface reduction rule configuration
Enable and validate automatic attack disruption in Microsoft Defender XDR for eligible attacks

Correct answer: B

Option review:

D: Endpoint security policy and ASR rules reduce attack surface on managed endpoints and are the direct control for blocking or auditing the targeted risky behavior. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

E: Automatic attack disruption uses correlated XDR signals to contain eligible active attacks across affected identities and devices while the investigation continues. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Learning point: Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Question 21

Two teams at Fourth Coffee propose different approaches for the night shift, response wave 11. The selection criterion is simple: the chosen approach must automatically apply the specified incident-management action when a Sentinel incident matches defined conditions. Which option should win the technical comparison if the SOC also wants to separate collection from detection logic?

Configure the automated investigation and response capability and its remediation behavior in Microsoft Defender XDR
Configure Microsoft Defender for Endpoint custom data collection for the endpoint data required by the investigation
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Enable or configure the required Microsoft Defender for Endpoint advanced feature in the Defender portal
Deploy the required endpoint security policy, including the appropriate attack surface reduction rule configuration

Correct answer: C

Option review:

A: Automated investigation and response can investigate supported alerts and take or recommend remediation actions, reducing manual triage for eligible incidents. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

D: Defender for Endpoint advanced features control optional endpoint capabilities and should be enabled when the requested investigation or protection capability depends on them. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

E: Endpoint security policy and ASR rules reduce attack surface on managed endpoints and are the direct control for blocking or auditing the targeted risky behavior. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

Learning point: Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Question 22

For the EMEA SOC, response wave 11, A. Datum wants the least indirect solution to this goal: orchestrate a multi-step automated response or external integration from Microsoft Sentinel. Which action aligns most closely with that requirement and the need to preserve investigation context?

Configure the appropriate email notification rule in Microsoft Defender XDR
Enable and validate automatic attack disruption in Microsoft Defender XDR for eligible attacks
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Configure the relevant Microsoft Defender for Endpoint rule setting for the endpoint behavior being managed
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Correct answer: C

Option review:

A: Defender XDR notification settings can send email for supported incident, action, and threat-analytics events so analysts receive the requested operational signal. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Learning point: Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Question 23

A modernization plan at Fabrikam Retail includes a endpoint containment exercise. The Sentinel administrator is asked to choose the control that specifically helps the organization automatically apply the specified incident-management action when a Sentinel incident matches defined conditions. Which choice fits best for the high-value-assets group, response wave 12 while supporting the goal to preserve investigation context?

Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Enable or configure the required Microsoft Defender for Endpoint advanced feature in the Defender portal
Tune the Defender XDR alert behavior, including suppression or correlation settings, for the identified signal
Configure Defender for Endpoint device groups with the required permissions and automation level
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Correct answer: A

Option review:

A: Sentinel automation rules evaluate incidents and can automatically update, assign, tag, close, or trigger response workflows when their conditions are met. This directly addresses the requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

B: Defender for Endpoint advanced features control optional endpoint capabilities and should be enabled when the requested investigation or protection capability depends on them. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

Learning point: Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Question 24

The privileged-users group, response wave 12 is moving into a controlled rollout at Adventure Works. Which action should be included when the stated security objective is to orchestrate a multi-step automated response or external integration from Microsoft Sentinel? The operational standard is to minimize manual analyst steps.

Configure Defender for Endpoint device groups with the required permissions and automation level
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Configure Microsoft Defender for Endpoint custom data collection for the endpoint data required by the investigation
Configure the relevant Microsoft Defender for Endpoint rule setting for the endpoint behavior being managed
Tune the Defender XDR alert behavior, including suppression or correlation settings, for the identified signal

Correct answer: B

Option review:

E: Defender XDR alert tuning is used to reduce unwanted alerts and improve how related security signals are surfaced and correlated for investigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Learning point: Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Question 25

Alpine Ski House is replacing an ad hoc process during a threat-hunting campaign. The replacement must reliably automatically apply the specified incident-management action when a Sentinel incident matches defined conditions. Which security-operations approach should the security operations analyst implement for the remote-user fleet, response wave 13 if the team also wants to minimize manual analyst steps?

Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Tune the Defender XDR alert behavior, including suppression or correlation settings, for the identified signal
Configure the appropriate email notification rule in Microsoft Defender XDR
Configure the automated investigation and response capability and its remediation behavior in Microsoft Defender XDR

Correct answer: B

Option review:

Learning point: Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Question 26

An audit finding for the production subscription, response wave 13 says the current process does not consistently orchestrate a multi-step automated response or external integration from Microsoft Sentinel. Which Microsoft security action most directly closes that gap while helping the SOC retain evidence for follow-up analysis?

Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Configure the automated investigation and response capability and its remediation behavior in Microsoft Defender XDR
Enable or configure the required Microsoft Defender for Endpoint advanced feature in the Defender portal
Configure Microsoft Defender for Endpoint custom data collection for the endpoint data required by the investigation
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Correct answer: E

Option review:

A: Sentinel automation rules evaluate incidents and can automatically update, assign, tag, close, or trigger response workflows when their conditions are met. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

B: Automated investigation and response can investigate supported alerts and take or recommend remediation actions, reducing manual triage for eligible incidents. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

D: Custom data collection extends the endpoint telemetry available to the security team for scenarios that require data beyond the default collection set. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

E: Sentinel playbooks use Logic Apps to orchestrate repeatable response steps and integrations that go beyond simple incident-field automation. This directly addresses the requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Learning point: Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Question 27

The incident responder at Lucerne Publishing needs a repeatable configuration for the regulated workload segment, response wave 14. It must automatically apply the specified incident-management action when a Sentinel incident matches defined conditions. Which choice should be implemented instead of relying on manual incident work if the goal is to retain evidence for follow-up analysis?

Configure Defender for Endpoint device groups with the required permissions and automation level
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Configure the automated investigation and response capability and its remediation behavior in Microsoft Defender XDR
Tune the Defender XDR alert behavior, including suppression or correlation settings, for the identified signal

Correct answer: C

Option review:

A: Device groups provide scope for endpoint access and automation settings, allowing organizations to separate administration and remediation behavior for different device populations. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

D: Automated investigation and response can investigate supported alerts and take or recommend remediation actions, reducing manual triage for eligible incidents. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

Learning point: Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Question 28

During readiness testing at Northwind Traders, the Tier 1 queue, response wave 14 fails a business requirement because analysts cannot yet orchestrate a multi-step automated response or external integration from Microsoft Sentinel. Which action should be implemented before rollout continues? The SOC also needs to avoid unnecessary alert noise.

Enable and validate automatic attack disruption in Microsoft Defender XDR for eligible attacks
Configure Microsoft Defender for Endpoint custom data collection for the endpoint data required by the investigation
Tune the Defender XDR alert behavior, including suppression or correlation settings, for the identified signal
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Deploy the required endpoint security policy, including the appropriate attack surface reduction rule configuration

Correct answer: D

Option review:

A: Automatic attack disruption uses correlated XDR signals to contain eligible active attacks across affected identities and devices while the investigation continues. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

B: Custom data collection extends the endpoint telemetry available to the security team for scenarios that require data beyond the default collection set. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

C: Defender XDR alert tuning is used to reduce unwanted alerts and improve how related security signals are surfaced and correlated for investigation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Learning point: Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Question 29

A governance review asks the Defender administrator to justify the control selected for the identity-response team, response wave 15. The requirement is to automatically apply the specified incident-management action when a Sentinel incident matches defined conditions. Which action has the clearest technical alignment while supporting the goal to avoid unnecessary alert noise?

Deploy the required endpoint security policy, including the appropriate attack surface reduction rule configuration
Configure Defender for Endpoint device groups with the required permissions and automation level
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Enable and validate automatic attack disruption in Microsoft Defender XDR for eligible attacks

Correct answer: C

Option review:

D: Sentinel playbooks use Logic Apps to orchestrate repeatable response steps and integrations that go beyond simple incident-field automation. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: automatically apply the specified incident-management action when a Sentinel incident matches defined conditions.

Learning point: Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Question 30

For a audit investigation, Blue Yonder Airlines needs a Microsoft security capability with this effect: Sentinel playbooks use Logic Apps to orchestrate repeatable response steps and integrations that go beyond simple incident-field automation. Which option most accurately provides that capability for the endpoint-response team, response wave 15? The process should preserve least privilege.

Deploy the required endpoint security policy, including the appropriate attack surface reduction rule configuration
Configure the automated investigation and response capability and its remediation behavior in Microsoft Defender XDR
Configure Defender for Endpoint device groups with the required permissions and automation level
Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow
Create a Microsoft Sentinel automation rule that matches the incident conditions and performs the required incident action

Correct answer: D

Option review:

A: Endpoint security policy and ASR rules reduce attack surface on managed endpoints and are the direct control for blocking or auditing the targeted risky behavior. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

B: Automated investigation and response can investigate supported alerts and take or recommend remediation actions, reducing manual triage for eligible incidents. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

C: Device groups provide scope for endpoint access and automation settings, allowing organizations to separate administration and remediation behavior for different device populations. It can be appropriate in another security-operations scenario, but it does not most directly address this requirement: orchestrate a multi-step automated response or external integration from Microsoft Sentinel.

Learning point: Create or configure a Microsoft Sentinel playbook backed by Azure Logic Apps for the required response workflow

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 26

Question 27

Question 28

Question 29

Question 30

Related posts: