SC-200 Practice Question: Arrange the steps to configure a Microsoft…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Step 1: Create a Logic App in Azure. Step 2: Configure the Sentinel trigger (e.g., "When a response to an Azure Sentinel incident is triggered"). Step 3: Add actions (e.g., send email, create ticket). Step 4: Save the playbook and link it to a Microsoft Sentinel automation rule.

  Why this is correct

  This is the correct order because you must first create the Logic App, then define the trigger that connects it to Sentinel incidents, then add the desired actions, and finally associate the playbook with an automation rule to activate it.

• ✗

  Step 1: Create a Microsoft Sentinel automation rule. Step 2: Create a Logic App. Step 3: Add actions. Step 4: Save and test.

  Why it's wrong here

  This order is invalid because the Microsoft Sentinel automation rule's 'Run playbook' action requires you to select an already deployed Logic App playbook from a dropdown; if the Logic App has not yet been created, the rule cannot be saved with a playbook reference. Furthermore, the automation rule's configuration includes permissions for the playbook's managed identity, which are assigned when the playbook is created, not before. The rule is the runtime invocation layer, not the definition layer, so it must come last after the Logic App and its trigger are fully configured and saved.

• ✗

  Step 1: Create a Logic App. Step 2: Add actions. Step 3: Configure the Sentinel trigger. Step 4: Link to automation rule.

  Why it's wrong here

  Configuring the Sentinel trigger is a prerequisite for adding actions because the Logic Apps designer uses the trigger's output schema to expose dynamic content such as the incident ID, severity, owner, and title. If you add actions first, they have no data source to draw from, and the workflow will fail validation because the trigger must be the first step of any Logic App. Additionally, the trigger's connection details and polling or webhook behavior determine how the playbook is initiated, so actions cannot be sensibly authored before that context exists.

• ✗

  Step 1: Configure Sentinel trigger. Step 2: Create a Logic App. Step 3: Add actions. Step 4: Link to automation rule.

  Why it's wrong here

  You cannot configure a Sentinel trigger in isolation because the trigger is a property of a Logic App resource—the Logic App must be provisioned in Azure before you can open its workflow designer and define the trigger. Attempting to create a trigger first would require a resource to contain it; there is no standalone Sentinel trigger service. Even if you think of the connector as a trigger type, it only exists inside a Logic App's workflow, so Step 1 must be the resource creation.

Go deeper

Related to this question