A security team wants to automatically block an IP address in Azure Firewall when a specific Sentinel incident is created. They have a playbook that does this. What is the required configuration to trigger the playbook automatically?

Add the playbook as an action in the analytics rule that generates the incident.

Use a logic app trigger of 'When a Microsoft Sentinel incident is created' and connect it to the playbook.

Configure the playbook to run on a schedule every 5 minutes.

Create an automation rule in Sentinel that runs the playbook when the incident is created.

A company wants to collect specific Windows event logs from their servers to detect suspicious PowerShell activity. They are using Microsoft Defender for Endpoint. What should they configure?

Use the 'Custom data collection' feature to specify the event log IDs.

Create a custom detection rule that collects the logs.

Configure a Windows Event Forwarding subscription to send logs to Defender.

Enable 'PowerShell logging' in advanced features.

In Microsoft Sentinel, what is the primary purpose of an automation rule?

To automate responses to incidents and alerts

To collect data from multiple sources

To create custom analytics rules

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 1

Configure Automation for Microsoft Defender XDR and Microsoft Sentinel SC-200 Practice Questions (Page 2)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

11concepts

40–45%of the exam

Questions 6–10

6application · medium
A security team wants to automatically block an IP address in Azure Firewall when a specific Sentinel incident is created. They have a playbook that does this. What is the required configuration to trigger the playbook automatically?
Select an answer first
7application · medium
A company wants to collect specific Windows event logs from their servers to detect suspicious PowerShell activity. They are using Microsoft Defender for Endpoint. What should they configure?
Select an answer first
8foundation · easy
In Microsoft Sentinel, what is the primary purpose of an automation rule?
Select an answer first
9foundation · easy
Which of the following can be an action in a Microsoft Sentinel automation rule?
Select an answer first
10foundation · easy
Which of the following is a capability of automatic attack disruption in Microsoft Defender XDR?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Configure Automation for Microsoft Defender XDR and Microsoft Sentinel SC-200 Practice Questions (Page 2)

Questions 6–10

A security team wants to automatically block an IP address in Azure Firewall when a specific Sentinel incident is created. They have a playbook that does this. What is the required configuration to trigger the playbook automatically?

A company wants to collect specific Windows event logs from their servers to detect suspicious PowerShell activity. They are using Microsoft Defender for Endpoint. What should they configure?

In Microsoft Sentinel, what is the primary purpose of an automation rule?

Which of the following can be an action in a Microsoft Sentinel automation rule?

Which of the following is a capability of automatic attack disruption in Microsoft Defender XDR?

Keep studying — Manage a security operations environment