Free Microsoft Cybersecurity SC-100 Actual Exam Questions - Question 11 Discussion
HOTSPOT You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1. You need to configure WS1 to meet the following requirements: • Create custom dashboards to visualize the workload of security analysts that use Microsoft Sentinel. • Enable automated responses for the security alerts generated by Microsoft Sentinel analytics rules. What should you use for each requirement? To answer, select the options in the answer area. NOTE: Each correct answer is worth one point. 
Workbooks for dashboards and Playbooks for automation, no doubt.
Workbooks nailed for dashboards, plus Playbooks handle alerts automation smoothly.
I’d say dashboards should be Workbooks since they let you build exactly what the analysts need visually. For the automated alert response part, Playbooks are the obvious pick because they’re designed to run Logic Apps workflows triggered by Sentinel alerts. The question basically points to those two tools for each task, so no need to overthink it. Using Workbooks and Playbooks covers both requirements perfectly without mixing things up.
Workbooks for dashboards, Playbooks for automated alert responses, simple as that.
I agree Workbooks fit dashboards since they're customizable and interactive. For automated responses, Playbooks make sense because they handle workflows triggered by alerts automatically. That combo meets both needs well.
For dashboards, definitely use Workbooks; for automated responses, go with Playbooks.