Exam AZ-500 topic 4 question 69 discussion

Answer: C, an Azure Logic App Reason: According to the documentation, workflow automation in Microsoft Defender for Cloud uses Logic Apps as the underlying automation platform. The Logic App needs to be created first as it defines the sequence of steps and actions that will be executed when security alerts or recommendations trigger the automation. Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation

Since the question is asking also for remediating the vulnerability, we need something more than just a logical app. The first thing is an automation account. The Steps: Create the Automation Account first. This sets up the environment where your remediation tasks (scripts) will be executed. Create Remediation Runbooks in the Automation Account. These runbooks will contain the scripts that fix vulnerabilities. Create a Logic App (optional) to trigger the remediation actions. You can have a Logic App listen for Azure Security Center alerts and then trigger the Automation Account's runbooks to perform the remediation. Why Automation Account First: Logic Apps will need the Automation Account to execute the remediation scripts. Without an Automation Account, you cannot run the remediation runbooks, so it must be created before the Logic App can use it.

Tricky, but documentation literally says "You need to first create the logic app" and that might be the basis for the question.

Answer: C Explanation: When you add a 'Add workflow automation' in step 2B of this create and assign workflow, you can either select and existing Logic App or Create one, regardless it is needed for assigning an 'Add workflow automation' b. The triggers that will initiate this automatic workflow. For example, you might want your Logic App to run when a security alert that contains "SQL" is generated. Reference: https://docs.microsoft.com/en-us/azure/security-center/workflow-automation

C. an Azure logic app

FROM MICROSFOT: This article describes the workflow automation feature of Microsoft Defender for Cloud. This feature can trigger consumption logic apps on security alerts, recommendations, and changes to regulatory compliance. For example, you might want Defender for Cloud to email a specific user when an alert occurs. You'll also learn how to create logic apps using Azure Logic Apps. THE LA WILL TRIGGER BASED ON AN ALERT RULE. THIS IS TRICKY ONE DEPENDING ON WHAT THEY ARE TRULY LOOKING FOR AS AN ANSWER. LOGIC APP IS CORRECT BUT WHEN THEY ADD THE WORD 'FIRST' I BELIEVE 'ALERT RULE' IS ACCURATE.

Under Azure Security Center (AKA. Windows Defender for Cloud) - Workflow automation - you will need to create a logic app to trigger (security alerts/recommendations/regulatory compliance) to users via email/azure resource manager roles etc. No need to create any Run-As accounts or MI for this. Done this a couple of times for my clients

C is the answer. https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation

Don't we need a (B) managed account first to be the authentication for the (C) Logic Apps? Azure Automation does not automatically create the Run As account, it has been replaced by using managed identities. https://learn.microsoft.com/en-us/azure/automation/automation-security-overview#managed-identities https://learn.microsoft.com/en-us/azure/automation/enable-managed-identity-for-automation https://learn.microsoft.com/en-us/azure/automation/quickstarts/create-azure-automation-account-portal

C. an Azure logic app

To create a workflow automation in Azure Security Center that will automatically remediate a security vulnerability, you should create an automation account first.

Not in exam. https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3VC70

Azure Security Center and Azure Defender are now called Microsoft Defender for Cloud. When Defender for Cloud detects a threat in any area of your environment, it generates a security alert. These alerts describe details of the affected resources, suggested remediation steps, and in some cases an option to trigger a logic app in response.

correct answer, check this out : https://docs.microsoft.com/en-us/azure/logic-apps/quickstart-create-first-logic-app-workflow

When you add a 'Add workflow automation' in step 2B of this create and assign workflow, you can either select and existing Logic App or Create one, regardless it is needed for assigning an 'Add workflow automation' ... b. The triggers that will initiate this automatic workflow. For example, you might want your Logic App to run when a security alert that contains "SQL" is generated. ... Ref: https://docs.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation