Using Sentinel automation rules and playbooks to minimize incident response effort

SC-200 By islever Editorial Last updated

Configure automation for Microsoft Defender XDR and Microsoft Sentinel

Short answer

CD Sentinel automation rules and playbooks together automate triage and remediation, minimizing manual response effort.

Question

You have an Azure subscription that uses Microsoft Sentinel. You need to minimize the administrative effort required to respond to the incidents and remediate the security threats detected by Microsoft Sentinel. Which two features should you use? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
  1. Microsoft Sentinel workbooks
  2. Azure Automation runbooks
  3. Microsoft Sentinel automation rules Correct Answer
  4. Microsoft Sentinel playbooks Correct Answer
  5. Azure Functions apps

Key Takeaways

Automation rules and playbooks are Sentinel's native response-automation pair: automation rules decide what happens when an incident is created, and playbooks execute the remediation logic, together reducing manual effort.

To minimize the administrative effort of responding to and remediating Sentinel incidents, use Microsoft Sentinel automation rules (which triage and auto-assign/close) together with playbooks (which run automated response actions), so the two features are the answer.

Common mistake: Choosing workbooks or Azure Automation runbooks/Functions — workbooks are for visualization, and Azure Automation runbooks/Functions are not the Sentinel-native pair the question targets for incident response.

Expert Analysis

Why the Answer Is Correct

Microsoft Sentinel automation rules and playbooks work together to automate incident response and remediation. Automation rules can automatically assign, tag, close, or trigger playbooks on incident creation, while playbooks (Logic Apps) run the actual response actions. This combination minimizes manual effort, which is exactly the requirement.

Why the Other Options Are Wrong

Sentinel workbooks (A) are for visualizing data, not responding. Azure Automation runbooks (B) and Azure Functions (E) are general Azure automation, not the Sentinel-native automation/playbook pair the question asks for.

Community Comment Notes

The community is unanimous (CD 100). MadLads explains that automation rules and playbooks automate detection, response, and remediation, reducing manual effort. Hawklx notes it is the same as an earlier question, and RedZtopics mistakenly suggests B and D, but the documented pair is automation rules + playbooks.

Official Reference

https://learn.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks

This link opens the official vendor documentation in a new tab.

Community Votes

CD
100%

100% of anonymous learners picked answer CD. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. MadLads 👍 2
    By using Microsoft Sentinel automation rules and Microsoft Sentinel playbooks, you can effectively automate the detection, response, and remediation processes, reducing the manual effort required and ensuring quicker and more consistent handling of security incidents.
  2. Hawklx 👍 4
    same question as 37 topic 3
  3. smanzana 👍 4
    Correct
  4. RedZtopics 👍 2
    for me B and D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide