AZ-500 Question 259
Select 2Your organization wants to automatically notify the security team in a Microsoft Teams channel whenever a new high-severity security alert is generated in Microsoft Defender for Cloud. The notification must include alert details and the affected resource. You plan to use workflow automation in Microsoft Defender for Cloud to accomplish this. Which two actions must you take? (Choose two.)
- A
Create a Logic App that uses a Teams connector to post messages, then configure it to receive triggers from Defender for Cloud.
- B
In Microsoft Defender for Cloud, create a workflow automation that targets ‘Security Alerts’ and select the Logic App as the destination.
- C
Enable advanced threat detection for all Azure Storage accounts so that the Logic App automatically receives every new alert.
- D
Configure a private endpoint for Microsoft Defender for Cloud so all high-severity alerts are securely routed to the Logic App.
Show answer and explanation
Correct answers: A, B
Explanation
To set up workflow automation with Microsoft Defender for Cloud, you create a Logic App that can process or notify recipients, then configure a workflow automation rule in the Defender for Cloud portal to trigger the Logic App on new security alerts. Refer to the official documentation at https://learn.microsoft.com/azure/defender-for-cloud/alerts-management/workflow-automation for detailed steps on creating Logic Apps and configuring workflow automation.
- A. Correct.
Option 1 is correct. You need a Logic App that contains an action to post to Microsoft Teams. By configuring it to accept triggers from Defender for Cloud, the Logic App can receive alert details and forward them appropriately.
- B. Correct.
Option 2 is correct. In Microsoft Defender for Cloud, workflow automation lets you specify a Logic App to automatically run when a new security alert is triggered. Selecting ‘Security Alerts’ ensures that only those events will trigger your notification workflow.
- C. Incorrect.
Option 3 is incorrect. Although enabling advanced threat detection for Storage accounts can help identify threats, it does not automatically route every alert to your Logic App. Workflow automation still needs to be configured to handle these alerts.
- D. Incorrect.
Option 4 is incorrect. A private endpoint is not required for sending high-severity alerts to a Logic App. While private endpoints provide secure connectivity, simply creating a workflow automation that references the Logic App is sufficient for alert forwarding.