SC-200 Sentinel Playbooks & Automation Quiz

1. True or False: Playbooks can modify or delete incidents in Azure Sentinel.

True

False

2. True or False: Playbooks can automatically block malicious IP addresses by updating network security groups.

True

False

3. What should you monitor to ensure playbooks are executing successfully?

Logic Apps run history and metrics

Sentinel analytics rules only

Azure Activity Log exclusively

Playbooks do not require monitoring

4. Which connector would you use to create a ticket in ServiceNow from a Sentinel playbook?

HTTP action

ServiceNow connector

Custom API connector

Webhook connector

5. True or False: You can schedule a playbook to run at specific times without relying on alerts.

True

False

Submit

7. How would you restrict a playbook to run only on high-severity incidents?

Add a condition action checking incident severity

Configure alert rule severity filters

Use playbook tags for severity filtering

Playbooks automatically filter by severity

8. Which of the following are best practices for playbook design? Select all that apply.

Use descriptive naming conventions

Include error handling and retry logic

Implement approval steps for critical actions

Avoid logging or monitoring playbook execution

Submit

9. What does SOAR stand for in the context of Sentinel playbooks?

Security Orchestration, Automation and Response

Secure Operations Automation Reporting

Security Operations and Automated Remediation

Sentinel Orchestrated Alert Response

Submit

11. What is the primary purpose of Azure Sentinel playbooks?

To automate incident response and orchestrate security workflows

To store and archive security logs

To generate compliance reports

To monitor network bandwidth usage

12. Which action would you use in a playbook to send a message to Microsoft Teams?

Send Email action

Post Adaptive Card action

Create Webhook action

Queue Message action

13. What is the maximum timeout duration for a playbook execution in Azure Logic Apps?

5 minutes

1 hour

24 hours

7 days

14. How can you test a playbook before deploying it to production?

Use the Run Trigger button in Logic Apps designer

Deploy to a test Sentinel workspace first

Both A and B

Playbooks cannot be tested before deployment

Submit

16. What permission is required to deploy playbooks in Azure Sentinel?

Reader role on the resource group

Logic App Operator or Contributor role

Global Administrator on Azure AD

Storage Account Contributor

17. Which of the following can be integrated with Sentinel playbooks? Select all that apply.

ServiceNow

Microsoft Teams

Slack

AWS S3

Submit

18. True or False: Playbooks can only be triggered manually in Azure Sentinel.

True

False

19. What trigger type automatically launches a playbook when an alert is created in Sentinel?

Manual trigger

Scheduled trigger

Alert trigger

Webhook trigger

20. Which service does Azure Sentinel playbooks use to automate workflows?

Azure Logic Apps

Azure Functions

Azure Automation Runbooks

Azure Data Factory

SC-200 Automating Response with Sentinel Playbooks Quiz

1. True or False: Playbooks can modify or delete incidents in Azure Sentinel.

2.

What first name or nickname would you like us to use?

2. True or False: Playbooks can automatically block malicious IP addresses by updating network security groups.

3. What should you monitor to ensure playbooks are executing successfully?

4. Which connector would you use to create a ticket in ServiceNow from a Sentinel playbook?

5. True or False: You can schedule a playbook to run at specific times without relying on alerts.

6. A playbook that enriches incidents with threat intelligence should ______ the incident with additional context.

7. How would you restrict a playbook to run only on high-severity incidents?

8. Which of the following are best practices for playbook design? Select all that apply.

9. What does SOAR stand for in the context of Sentinel playbooks?

10. To ______ a user account during a security incident, a playbook can integrate with Azure AD.

11. What is the primary purpose of Azure Sentinel playbooks?

12. Which action would you use in a playbook to send a message to Microsoft Teams?

13. What is the maximum timeout duration for a playbook execution in Azure Logic Apps?

14. How can you test a playbook before deploying it to production?

15. A playbook that responds to phishing alerts should ______ the user's mailbox and notify security team.

16. What permission is required to deploy playbooks in Azure Sentinel?

17. Which of the following can be integrated with Sentinel playbooks? Select all that apply.

18. True or False: Playbooks can only be triggered manually in Azure Sentinel.

19. What trigger type automatically launches a playbook when an alert is created in Sentinel?

20. Which service does Azure Sentinel playbooks use to automate workflows?