SC-200 Certification Practice Question #179

Question

You have an Azure subscription that uses Microsoft Defender for Cloud.

You need to use an Azure Resource Manager (ARM) template to create a workflow automation that will trigger a logic app when specific alerts are received by Microsoft Defender for Cloud.

How should you complete the template? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The blank precedes `/workflows`, and the Azure resource type for a Logic App workflow is `Microsoft.Logic/workflows`. The `logicAppResourceId` in a Defender for Cloud workflow automation must point at the Logic App being triggered, so it references the Microsoft.Logic provider. MS Learn's Defender for Cloud ARM quickstart confirms the two resources involved are `Microsoft.Security/automations` (the automation) and `Microsoft.Logic/workflows` (the triggerable Logic App), and the automation's logicAppResourceId targets the latter. The other options are wrong: Microsoft.Security owns `/automations` (not `/workflows`), Microsoft.Automation is for Azure Automation runbooks, and Microsoft.AlertsManagement does not expose `/workflows`. The community is unanimous (Optimizor_IT 19 👍, Wiggy 5 👍, plus multiple corroborating comments) and aligns with MS Learn, supporting high confidence.

More SC-200 practice questions