AZ-500 Question 261
Select 2Your organization uses Slack as a team communication tool and wants to automatically post any high-severity alerts from Microsoft Defender for Cloud to a designated Slack channel. You plan to use workflow automation in Microsoft Defender for Cloud to accomplish this. Which two actions must you perform as part of your configuration?
- A
Create a new workflow automation in Microsoft Defender for Cloud, specify the filter condition “Severity equals High,” and link it to an existing Logic App.
- B
In the Logic App, use the 'When a security alert is created (Microsoft Defender for Cloud)' trigger and add a Slack 'Post message' action to send the alert details.
- C
Enable Just-in-Time (JIT) VM access in Microsoft Defender for Cloud to selectively route only high-severity alerts to Slack channels.
- D
Implement Microsoft Sentinel to capture all alerts and forward them to Slack using a built-in connector, bypassing Microsoft Defender for Cloud workflow automation.
Show answer and explanation
Correct answers: A, B
Explanation
To configure workflow automation in Microsoft Defender for Cloud for alerting scenarios, you must create or use a Logic App that is triggered by relevant security alerts. In Defender for Cloud, you define a workflow automation condition (in this case, filtering for high-severity alerts) and then link it to the Logic App. The Logic App itself should include an action to post messages to Slack. Refer to Microsoft’s documentation on 'Workflow automation in Microsoft Defender for Cloud' for detailed steps and best practices.
- A. Correct.
This is correct. You must create a workflow automation in Microsoft Defender for Cloud and set the condition to only trigger for high-severity alerts. Linking this filter to a Logic App ensures that only relevant alerts are processed.
- B. Correct.
This is correct. The Logic App must be configured with the proper trigger for Microsoft Defender for Cloud alerts (previously known as Azure Security Center alerts). Then, use a Slack action (for instance, 'Post message') to send notifications to the specified channel.
- C. Incorrect.
This is incorrect. While JIT VM access is a feature within Microsoft Defender for Cloud, enabling or configuring JIT does not automatically filter high-severity alerts or direct them to Slack. JIT is intended to reduce attack surface on VMs, not filter alert severity.
- D. Incorrect.
This is incorrect. Although Microsoft Sentinel can ingest alerts from various sources, including Defender for Cloud, the question specifically requires configuring the workflow automation within Microsoft Defender for Cloud. Using Sentinel would introduce an additional solution that is not necessary for the stated scenario.