Exam SC-200 topic 2 question 3 discussion

passed exam 31-Jan-2022, and answer Workflow Automation was not on exam... so.. I have chosen : Security Alerts

"automatically remediate security risks detected" - risks is the key word, that (to me) assumes the recommendations - and not alerts (which would be incidents). And it would be triggered on recommendations.

what's the final answer?

"When an Azure Security Center Recommendation is created or triggered" "Recommendations" Important part of the question: "You need to test LA1 in Security Center" To test a Logic app, you want to manually trigger the app. To do this, you go to Recommendations > open a recommendation > select "Trigger a logic app" https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation#manually-trigger-a-logic-app

The given anwser is correct: To test the Azure Logic App (LA1) in Security Center, you should configure the following options: Set the LA1 trigger to: When an Azure Security Center alert is created or triggered Trigger the execution of LA1 from: Workflow automation This setup will allow LA1 to be automatically triggered when a security alert is created or triggered in Azure Security Center, and you can test its functionality through the workflow automation feature.

Second. Second. Why Not "Recommendations"? If you select "When an Azure Security Center Recommendation is created or triggered," the Logic App would run whenever a recommendation is generated. However, since recommendations are not active threats but rather suggestions, this would not align with the objective of remediating actual security risks.

1. security risks - Security recommendations IMO, security threats are for Security Alert 2. Manually trigger a logic app You can also run logic apps manually when viewing any security alert or recommendation. To manually run a logic app, open an alert, or a recommendation and select Trigger logic app. We set the LA to be triggered by Security Recommendation that means we can manually trigger it via the Security Recommendation.

1. When an Azure Security Centre Recommendation is created or triggered 2. Security Alerts

My opinion is for LA1 to trigger should be based on the Alert and Proof is below - logicAppResourceId": { "type": "String", "metadata": { "displayName": "Logic App", "description": "The Logic App that is triggered.", "strongType": "Microsoft.Logic/workflows", "assignPermissions": true } }, "logicAppTrigger": { "type": "String", "metadata": { "displayName": "Logic app trigger", "description": "The trigger connector of the logic app that is triggered. Possible values: 'Manual (Incoming HTTP request)', 'When an Azure Security Center Alert is created or triggered'." The above mentioned is the code for Logic App config which is set to trigger when an Azure Security alert is created or triggered. Correct me If I'm wrong

check answer

Based on this below article about a similar lab this lad did, I think the answer is: 1. When an Azure Security Centre Recommendation is created or triggered 2. Security Alerts https://security.packt.com/setting-up-automated-threat-response-in-microsoft-defender-for-cloud-azure-security-center/ Open for debate though...

https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation#create-a-logic-app-and-define-when-it-should-automatically-run trigger based on alerts and workspace automation

First one is correct. Second is: Security Alerts

On the exam July 7 2023

be careful not to mistake with Question #39

Trigger is Security alert because of security risk. Workflow automation used to response to a security risk/incident https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation#create-a-logic-app-and-define-when-it-should-automatically-run

Question in Exam today