AZ-500 Question 260
Select 2You have configured a workflow automation in Microsoft Defender for Cloud to trigger a Logic App whenever a high-severity security alert is generated. Despite creating multiple high-severity alerts in your environment, the Logic App isn’t receiving any triggers. You suspect the workflow automation settings might not be filtering the alerts correctly. Which two steps should you take to ensure the Logic App is triggered only for high-severity alerts?
- A
In the workflow automation’s configuration, set the Event Source to ‘Security Alerts’ and add a condition filtering High severity.
- B
Add the Azure Logic App as a remediation task for security recommendations under the Regulatory compliance section.
- C
Enable the workflow automation at the subscription scope and specify the condition 'Severity equals High' within the automation settings.
- D
Switch the Logic App connector in Microsoft Defender for Cloud from the built-in Security Connector to a custom API connection.
Show answer and explanation
Correct answers: A, C
Explanation
To configure workflow automation in Microsoft Defender for Cloud so that a Logic App is triggered for specific alerts, you must ensure the correct Event Source (Security Alerts) and relevant conditions (Severity equals High) are set. Additionally, you must enable the automation at the required scope (subscriptions or management groups) to capture the alerts you want. For more information, refer to Microsoft Defender for Cloud documentation: https://learn.microsoft.com/azure/defender-for-cloud/alerts-workflow-automation.
- A. Correct.
Correct. For a workflow to trigger on security alerts, you must set the Event Source to ‘Security Alerts’ and then add a filter (e.g., severity = High). This ensures only high-severity alerts trigger the Logic App.
- B. Incorrect.
Incorrect. Regulatory compliance tasks in Microsoft Defender for Cloud are separate from the Security Alerts triggers. Associating the Logic App with regulatory compliance recommendations will not capture active security alerts.
- C. Correct.
Correct. You need to confirm the automation is enabled at the right scope (e.g., specific subscription or all subscriptions). Within that automation configuration, specify ‘Severity equals High’ so only relevant alerts are sent to the Logic App.
- D. Incorrect.
Incorrect. Switching to a different type of connector does not address the alert filtering issue. You can continue using the built-in connector for Security Alerts as long as the configuration is correct.