Exam SC-200 topic 3 question 6 discussion

am I the only one that thinks its C ?????

The answer is correct. You need to add a new parameter in Send email action. That parameter specifies who you want to send to.

To modify your Azure Sentinel playbook so that it sends an email to the owner of the resource instead of a distribution group, follow these steps: - Use the Microsoft Sentinel API or Azure Logic Apps connectors to extract the resource owner's email from the incident or alert. - Modify the Email Action in the Playbook - Test the Playbook Source: Copilot

Correct Answer: C. Add a condition and modify the action A. Add a parameter and modify the trigger – Parameters are useful for input customization but don't help identify and dynamically use the resource owner’s email. B. Add a custom data connector and modify the trigger – This is unnecessary unless you're bringing in data from a completely new source. For this task, the owner info can usually be obtained from existing data or a Graph API call. D. Add an alert and modify the action – The alert already exists. You don’t need to create a new alert to change how the playbook behaves. The correct approach is to add a condition (to check or process the owner) and modify the email action to target the resource owner instead of a distribution group.

A. While this option is plausible, it assumes the resource owner’s identity is readily available in the trigger payload, which isn’t guaranteed without additional steps. C. This approach could work if you retrieve the resource owner’s details (e.g., via an Azure Resource Manager or Microsoft Graph API call) and use a condition to decide when/how to send the email to that owner instead of the group. This is a practical way to adjust the recipient dynamically within the workflow. I would go with C.

Answer is C. Your goal is to send it to the owner of the resource. So you can use multiple Condition statements in your Logic App workflow to achieve this. https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-control-flow-conditional-statement?tabs=standard

Playbook is just a logic app. The trigger is already configured, so just add a parameter & use it in the action later.

To modify the playbook to send an email to the owner of the resource instead of the distribution group, you should choose Option A: Add a parameter and modify the trigger. In Azure Sentinel, a playbook is essentially a Logic App. To change the recipient of the email, you would need to modify the action that sends the email. This can be done by adding a parameter to the action that specifies the owner of the resource as the recipient. The trigger of the Logic App determines when the Logic App is run. If the trigger is currently set to run when an alert is generated, you would not need to modify the trigger to change the recipient of the email. However, if the trigger is not currently set to run when the resource owner changes, you would need to modify the trigger as well.

This should be C

A is the correct!! https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/forensic-artifacts-in-office-365-and-where-to-find-them/ba-p/3634865

In order to save the email of the owner of that resource, we need to use a parameter. A is the only option that mentions the parameter.

Correct

I have a playbook like this in my lab. The Condition>Action is where we tell the playbook that we want it to email out and who we want to email it out to. So if you edit the condition and then the action we can change who gets the email when the playbook is triggered.

To modify the playbook to send the email to the owner of the resource instead of the distribution group, you should do the following: Add a parameter and modify the trigger. This option allows you to define a custom value that the playbook uses, such as the email address of the resource owner. You can then use this parameter in the trigger condition or in the action settings4. Add a condition and modify the action. This option allows you to check if the alert is related to the resource owner and then send an email to them using the Office 365 Outlook connector. The other two options are not correct because: Adding a custom data connector and modifying the trigger will not change the email recipient, but rather create a new source of data for Azure Sentinel. Adding an alert and modifying the action will not change the email recipient, but rather create a new alert based on a condition or logic app action.

I would think A make more sense then D since the question wants to change the email recipient and not add a new one. So changing the Trigger is required.

It is D. Just go build a playbook. https://learn.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook?tabs=LAC%2Cincidents The trigger would not need to change. So you are left with C and D. Adding a condition will not help you email the resource owner but an alert will. You add a new alert that includes the resource owner and then set the action to use that alert based on the condition and trigger that were already working.

I would Agree with @So_Surreall on this one. The most professional answer would be to validate is the owner is defined and send to it. If no owner is defined then send to the DL...