SC-200 Certification Practice Question #64

Question

You use Azure Defender.
You have an Azure Storage account that contains sensitive information.
You need to run a PowerShell script if someone accesses the storage account from a suspicious IP address.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

The requirement is to automatically run a PowerShell script when a suspicious-IP alert fires on the storage account. Microsoft Defender for Cloud's workflow automation feature triggers a consumption logic app on security alerts, so you need two parts: (C) a logic app whose trigger is an Azure Security Center / Defender for Cloud alert (the trigger named "When a Defender for Cloud Alert is created or triggered"), which executes the PowerShell, and (A) a workflow automation rule that binds the alert to that logic app. The official Suggested Answer lists only C, but C alone doesn't connect the alert to the logic app — the workflow automation (A) is what actually invokes it on the alert. The community overwhelmingly (21 votes, multiple high-vote comments) selects AC, and MS Learn confirms both pieces are required. A manual trigger (B) or HTTP trigger (D) would not auto-fire on the alert, and an app registration (E) is irrelevant.

More SC-200 practice questions