MENU
You have a Microsoft Sentinel playbook that is triggered by using the Azure Activity connector.
You need to create a new near-real-time (NRT) analytics rule that will use the playbook.
What should you configure for the rule?
Suggested Answer: B
Get Premium SC-200 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
28 comments · newest first
AL
Alyssa
11 months ago
I agree, the Alert automation settings make the most sense here.
GE
Gerald
11 months ago
Wait, are we sure about that? Seems a bit off.
GL
Glory
12 months ago
Definitely the query rule! That's the right choice.
HY
Hyman
12 months ago
I think it's actually the Incident automation settings.
SH
Shantell
1 year ago
You need to configure the Alert automation settings for the rule.
TO
Tomas
1 year ago
I feel like the Alert automation settings could be the key here. We practiced a similar question where automation was crucial for responding to alerts.
LE
Leah
1 year ago
Entity mapping sounds familiar, but I don't recall it being directly related to triggering playbooks. It might be more about identifying specific entities in the data.
MI
Mike
1 year ago
I think we might need to look at the query rule since it’s tied to how the analytics rule operates, but I could be mixing it up with another question.
JA
Jaclyn
1 year ago
I remember something about configuring automation settings for alerts, but I'm not entirely sure if it's the right one for this scenario.
FR
Francoise
1 year ago
I'm confident that the correct answer is C, the query rule. The playbook is triggered by the Azure Activity connector, so the analytics rule needs to be configured to use that.
WI
Willard
1 year ago
Okay, let me think this through. The question mentions a near-real-time (NRT) analytics rule, so I'm guessing it's the query rule that needs to be set up to use the playbook.
RY
Ryan
1 year ago
I'm a bit unsure about this one. Is it the Incident automation settings or the Alert automation settings that I need to configure?
BE
Becky
1 year ago
Hmm, this one seems straightforward. I think the key is to configure the query rule to trigger the playbook.
DA
Davida
1 year ago
This seems like a good opportunity to apply my understanding of MPLS label stacking and popping. I'll carefully evaluate each option to identify the one that doesn't match the expected behavior.
ME
Melissa
1 year ago
I'm feeling pretty confident about this one. The key will be setting up the secondary replica and managing the failover process effectively.
JA
Jamal
1 year ago
Okay, I think the key here is to consider the specific risks and threats that come with an abrupt changeover. Comprehensive testing and documentation will be crucial, but I also can't ignore the importance of a solid change management process.
SE
Selene
1 year ago
Okay, let's think this through. I could try to do a descriptive assessment and collect some baseline data, but that might not be the best approach for a potential mood disorder. I think the safest option is to consult with other professionals who have the right expertise.
AN
Anastacia
3 years ago
That's a good point, Glory. But I think the question is asking specifically about what we need to configure for the rule itself, not the playbook. So I still think C) the query rule is the best answer.
GL
Glory
3 years ago
Hmm, I'm not so sure. What about the Incident automation settings? Couldn't that be a valid option since the playbook is being triggered by the Azure Activity connector?
HO
Honey
3 years ago
I agree with Candida. The question specifically states that we need to create a new NRT analytics rule, so the query rule is the logical choice here.
CA
Candida
3 years ago
Hmm, that's an interesting thought, David. But I still think the query rule is the most important thing to configure for a new NRT analytics rule. The other settings are more about what happens after the rule is triggered.
EA
Earlean
3 years ago
G: the Alert automation settings
JO
Johnetta
3 years ago
F: Definitely, without the right query rule, the playbook won't be effective.
JE
Jean
3 years ago
E: the query rule
AL
Alfreda
3 years ago
D: I think the query rule is the key to making the playbook work efficiently.
CA
Casie
3 years ago
C: the Incident automation settings
YA
Yan
3 years ago
B: Yes, I agree. The query rule is essential for the new NRT analytics rule.
RO
Roxane
3 years ago
A: the query rule