Exam SC-200 topic 6 question 3 discussion

C. Microsoft Sentinel automation rules D. Microsoft Sentinel playbooks Explanation Microsoft Sentinel automation rules allow you to automate common incident handling tasks. You can create rules that automatically run when new incidents are created or updated. These rules can perform actions like changing the incident's status, assigning an owner, adding tags, or, crucially, running a playbook. This significantly reduces manual effort by triaging and managing incidents automatically. Microsoft Sentinel playbooks (which are based on Azure Logic Apps) provide powerful automation capabilities for response and remediation. When an incident triggers an automation rule, that rule can invoke a playbook. Playbooks can then execute a sequence of actions, such as blocking an IP address on a firewall, disabling a user account in Azure AD, isolating a virtual machine, or sending notifications. This automates complex response workflows, minimizing the need for manual intervention and speeding up threat remediation.

Correct

same question as 37 topic 3

By using Microsoft Sentinel automation rules and Microsoft Sentinel playbooks, you can effectively automate the detection, response, and remediation processes, reducing the manual effort required and ensuring quicker and more consistent handling of security incidents.

for me B and D