SC-200 Certification Practice Question #78

Question

You have an Azure subscription that uses Microsoft Defender for Cloud and contains an Azure logic app named app1.

You need to ensure that app1 launches when a specific Defender for Cloud security alert is generated.
How should you complete the Azure Resource Manager (ARM) template? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The ARM template creates a Defender for Cloud workflow automation that launches app1 when a specific alert fires. Per the official quickstart template, the resource that performs this is of type `Microsoft.Security/automations` (an empty `Microsoft.Logic/workflows` logic app already exists as app1 — the automation is the new resource that wires the alert to it). Inside that automation's action, the logic app is invoked via `listCallbackURL(resourceId(... 'Microsoft.Logic/workflows/triggers' ... 'manual'), '2019-05-01')` — the callback URL is obtained from the workflow's `triggers` resource type (the `manual` trigger), so the dropdown after `Microsoft.Logic/workflows/` resolves to `triggers`. Both selections are verified verbatim against the MS Learn ARM template. Confidence is 89 (a confidently resolved HOTSPOT) rather than higher because the file records no explicit Suggested Answer letter, only community "answer is correct" confirmations anchored to the exact quickstart doc.

More SC-200 practice questions