A security team uses Microsoft Sentinel and has an automation rule that triggers on incident creation and runs a playbook to assign incidents to the on-call analyst. They now want to add a second playbook that sends a notification to a Teams channel, but only for incidents with a specific tag. They want to minimize the number of automation rules and avoid running the Teams notification playbook for incidents that are already resolved. What should they do?

Create a second automation rule that triggers on incident creation and runs the Teams notification playbook for all incidents.

Modify the Teams notification playbook to check the incident status and tag, and then run it from the existing automation rule without adding conditions.

Modify the existing automation rule to add a condition for the tag and add an action to run the Teams notification playbook, and set the rule to trigger on incident creation and update.

Create a new automation rule that triggers on incident update and runs the Teams notification playbook only for incidents with the tag.

A company wants to delegate the management of Microsoft Defender for Endpoint to two different teams: one for the 'Marketing' device group and one for the 'IT' device group. Each team should have full control over their respective group but no access to the other group. What should you configure?

Create two separate tenants and assign each team to one tenant.

Use conditional access policies to restrict access to the Microsoft Defender portal based on the user's department.

Create two device groups and assign each team the appropriate permissions using role-based access control (RBAC) scoped to each group.

Assign both teams the 'Global administrator' role and rely on them to only manage their respective groups.

In Microsoft Sentinel, what is a playbook?

A dashboard for visualizing security data

A collection of automated procedures that can be triggered in response to incidents

A data connector for ingesting logs

A type of analytics rule for detecting threats

Microsoft Certified:Security Operations Analyst Associate

Domain 1Objective 1

Configure Automation for Microsoft Defender XDR and Microsoft Sentinel SC-200 Practice Questions (Page 6)

Part of the Manage a security operations environment domain, which accounts for 40–45% of the SC-200 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~16–29 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

11concepts

40–45%of the exam

Questions 26–30

26foundation · easy
In Microsoft Defender for Endpoint, which rules setting allows you to define custom indicators of compromise (IOCs) for detection?
Select an answer first
27foundation · easy
Which setting in Microsoft Defender for Endpoint controls the automatic remediation actions taken on devices?
Select an answer first
28expert · hard
A security team uses Microsoft Sentinel and has an automation rule that triggers on incident creation and runs a playbook to assign incidents to the on-call analyst. They now want to add a second playbook that sends a notification to a Teams channel, but only for incidents with a specific tag. They want to minimize the number of automation rules and avoid running the Teams notification playbook for incidents that are already resolved. What should they do?
Select an answer first
29application · medium
A company wants to delegate the management of Microsoft Defender for Endpoint to two different teams: one for the 'Marketing' device group and one for the 'IT' device group. Each team should have full control over their respective group but no access to the other group. What should you configure?
Select an answer first
30foundation · easy
In Microsoft Sentinel, what is a playbook?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-200

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-200” is a trademark of its owner, used for identification only.

Configure Automation for Microsoft Defender XDR and Microsoft Sentinel SC-200 Practice Questions (Page 6)

Questions 26–30

In Microsoft Defender for Endpoint, which rules setting allows you to define custom indicators of compromise (IOCs) for detection?

Which setting in Microsoft Defender for Endpoint controls the automatic remediation actions taken on devices?

A company wants to delegate the management of Microsoft Defender for Endpoint to two different teams: one for the 'Marketing' device group and one for the 'IT' device group. Each team should have full control over their respective group but no access to the other group. What should you configure?

In Microsoft Sentinel, what is a playbook?

Keep studying — Manage a security operations environment