SC-200 Exam Dumps : Microsoft Security Operations Analyst

Azure Sentinel “playbooks” are Azure Logic Apps . Granting the minimal permissions to configure (create/edit) playbooks requires the Logic App Contributor role on the resource group where the playbooks reside. This satisfies the business requirement to use least privilege and specifically enables admin1 to design, modify, and manage Logic Apps that Sentinel automation rules or analytics rules will invoke. Roles like Automation Operator or Automation Runbook Operator apply to Azure Automation , not Logic Apps, and therefore don’t allow creating or editing Sentinel playbooks. Azure Sentinel Contributor allows managing Sentinel resources (incidents, analytics rules, workbooks) but, by itself, does not grant permissions to author Logic Apps. Assigning Logic App Contributor provides precisely what is needed to configure Sentinel playbooks without unnecessary broader permissions.

To remediate active attacks automatically once alerts or incidents are detected, Microsoft Sentinel uses playbooks , which are workflows built on Azure Logic Apps . These playbooks can execute remediation actions—such as isolating a machine, blocking an account, or triggering other security control chang es—without manual intervention. Microsoft’s documentation clearly states that “playbooks in Microsoft Sentinel are based on workflows built in Azure Logic Apps” and that they can “automate and orchestrate your threat response by using playbooks … run a pla ybook on-demand or automatically in response to specific alerts or incidents.”

When an analytics rule in Sentinel triggers an alert or incident, you can attach an automation rule which in turn invokes a playbook (i.e. a Logic Apps workflow) to perform the remediation steps. The automation rule defines the trigger conditions and calls the playbook action as part of its response actions.

Let us evaluate other options:

Azure Automation runbooks (Option A) are powerful for scripting in Azure (e.g., PowerShell o r Python) and can perform remediation tasks, but they are not the native mechanism within Sentinel for orchestrated, alert-driven response workflows.

Azure Functions (Option C) are serverless compute for custom code, but you would have to build and integra te orchestration logic manually; they are not the out-of-box SOAR component in Sentinel.

Azure Sentinel livestreams (Option D) is not a recognized remediation automation component—it is irrelevant in this context.

Therefore, the correct solution to remedia te active attacks (triggering automated actions in response to alerts/incidents with minimal manual effort) is to use Azure Logic Apps (via Sentinel playbooks) as the orchestration engine. Logic Apps are the documented foundation of Sentinel’s automation r esponse capabilities.

When configuring the Syslog via Azure Monitor Agent (AMA) connector in Microsoft Sentinel , the Data Collection R ule (DCR) determines which Linux system logs are ingested. Syslog messages are filtered based on facility (the subsystem that generated the message) and severity level (priority) .

According to Microsoft’s “Collect Syslog data sources using Azure Monitor Ag ent” documentation:

“Syslog facilities define which type of process generated the log (e.g., authentication, cron, daemon), and log levels define the severity (0=emerg, 1=alert, 2=crit, 3=err, etc.). To minimize data ingestion and cost, select only the fac ility and the highest severity level required for your investigation.”

In this scenario:

You need to collect logs related to App1 , a background process (non-kernel, non-authentication, non-cron). Typically, such custom or application-level processes send logs to LOG_AUTH or LOG_DAEMON , depending on configuration. If App1 is an application that uses authentication or security features, the LOG_AUTH facility is appropriate.

You must collect only logs with a critical priority , which corresponds to Syslog severity 2 (critical) . In Syslog terminology, that maps to the LOG_EMERG or “emergency” level and above.

However, to ensure minimum data collection while still capturing critical events, Sentinel’s best practice is to configure the Syslog DCR to collect on ly the specific facility associated with the application and the exact required severity level. For “critical only,” LOG_EMERG is the correct choice because it ensures that only the most urgent (critical/emergency) events are ingested, reducing data volume and cost.

✅ Final Configuration:

Setting

Correct Option

Purpose

Facility

LOG_AUTH

Collects security/authentication-related logs for App1

Log level

LOG_EMERG

Collects only critical/emergency events (priority ≤ 0) to minimize ingestion volume

In summary:

Selecting LOG_AUTH and LOG_EMERG satisfies both requirements — capturing only the highest-severity logs relevant to App1 while keeping the ingestion volume minimal, in line with Microsoft Sentinel Syslog DCR configuration guidance.