Microsoft SC-200 Exam Dumps

Automated Investigation and Response (AIR) automates investigation and remediation actions for alerts that Defender already detects: it triages alerts, runs investigation playbooks, and can execute remediation (quarantine files, terminate processes, remove persistence) based on the investigation outcome. AIR is powerful for reducing analyst load and quickly remediating detected threats. However, AIR only runs in response to detections/alerts it receives---if the third-party AV completely misses an artifact and no EDR/behavioral detection generates an alert, AIR will not be triggered. In contrast, EDR in block mode is specifically built to catch post-breach detections that the primary AV missed and to remediate them. Therefore, enabling AIR alone does not guarantee protection from artifacts missed by the third-party antivirus; AIR helps remediate once a detection exists but does not itself create the missed detection coverage that EDR in block mode provides.

Azure Sentinel Contributor can create and edit workbooks, analytics rules, and other Azure Sentinel resources.

https://docs.microsoft.com/en-us/azure/sentinel/roles

The case study requires:

''Ensure that the Group1 members can create and edit playbooks.''

In Microsoft Sentinel, the ability to create, edit, and assign playbooks is granted by the Microsoft Sentinel Automation Contributor role. This role allows users to:

Create and manage automation rules,

Create and edit playbooks (Logic Apps) in the connected subscription,

Associate playbooks with Sentinel incidents or alerts.

By contrast:

Logic App Contributor allows Logic App creation but doesn't include Sentinel-level integration permissions.

Automation Operator can run playbooks but not edit or create them.

Sentinel Playbook Operator can execute playbooks but cannot modify or assign them.

Answer for Question 11: A. Microsoft Sentinel Automation Contributor

To investigate which accounts generate the most alerts and correlate them with incident data, Microsoft Sentinel requires a solution package that provides identity-focused analytics and workbooks.

The Cloud Identity Threat Protection Essentials solution from the Microsoft Sentinel Content hub delivers:

Prebuilt workbooks and analytics rules integrating Azure Activity, Entra ID logs, and Defender XDR alerts.

Visualizations showing users with most alerts and related incidents.

UEBA integration is optional, but installing this solution automatically provides identity-centric detection with minimal configuration.

UEBA (User and Entity Behavior Analytics), by itself, detects anomalies but does not provide built-in alert correlation dashboards. Therefore, to meet the requirement with minimal administrative effort, installing the prebuilt Sentinel content package is the correct step.

Correct Answe r: B. From Content hub, install Cloud Identity Threat Protection Essentials