SC-200 Certification Practice Question #79

Question

You have an Azure subscription that has Microsoft Defender for Cloud enabled for all supported resource types.

You create an Azure logic app named LA1.

You plan to use LA1 to automatically remediate security risks detected in Defender for Cloud.

You need to test LA1 in Defender for Cloud.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The phrasing "remediate security risks detected in Defender for Cloud" maps to recommendations (configuration risks), not alerts (active incidents). MS Learn lists "When a Microsoft Defender for Cloud recommendation is created or triggered" as a first-class supported trigger and states a logic app can be manually run from a recommendation by selecting "Trigger logic app" — exactly the test action the question asks for. The strongest logical point (user636, JoeP1) is that the manual-execution surface must match the configured trigger type: if LA1 triggers on a recommendation, you test it from Recommendations. The two highly-voted comments are split almost evenly (22 vs 21), which is why confidence is held in the high-70s, but the MS Learn tiebreaker and the trigger-type-consistency argument favor Recommendation/Recommendations.

More SC-200 practice questions