You onboard Azure Sentinel. You connect Azure Sentinel to Azure Security Center. You need to automate the mitigation of incidents in Azure Sentinel. The solution must minimize administrative effort…

Question

Options

• Aan alert rule
• Ba playbook
• Ca function app
• Da runbook

• A
  74% (28)
• B
  8% (3)
• C
  3% (1)
• D
  16% (6)

Explanation

Explanation

Wait - let me flag an important issue: the marked correct answer (A) appears to be incorrect. The widely accepted correct answer for this scenario is B. a playbook.

Why B (Playbook) is correct: In Azure Sentinel (now Microsoft Sentinel), playbooks are the built-in automation mechanism used to respond to and mitigate incidents. Playbooks are built on Azure Logic Apps and can be triggered automatically by alert or incident rules, requiring minimal administrative effort once configured - making them the ideal solution for automated incident mitigation.

Why the distractors are wrong:

• A. Alert rule - Alert rules detect and generate incidents/alerts; they do not automate mitigation or remediation actions.
• C. Function app - While Azure Functions can perform automation, they require significantly more custom development effort, violating the "minimize administrative effort" requirement.
• D. Runbook - Runbooks belong to Azure Automation and are more native to Azure Security Center/Defender remediation workflows, not Sentinel's built-in automation framework.

Memory tip: Think "P for Protection" - Playbooks protect and respond in Sentinel. If the question mentions Sentinel + automated response/mitigation, always think Playbook first.

Flag this question if encountered on practice exams - the marked answer (A) contradicts official Microsoft documentation.

No community discussion yet for this question.