How Should You Test LA1 for Security Center Risk Remediation?
Answer
Select When an Azure Security Center Recommendation is created or triggered as the workflow trigger, then test LA1 by manually triggering it from Recommendations in Security Center.
HOTSPOT You have an Azure subscription that has Azure Defender enabled for all supported resource types. You create an Azure logic app named LA1. You plan to use LA1 to automatically remediate security risks detected in Azure Security Center. You need to test LA1 in Security Center. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area: [sampleXML/xmlfile-56_1.png]
Community Insight
The question tests whether you map 'security risks' to recommendation-triggered workflow automation and know the manual test path; the trap is treating risks as alerts and selecting Security alerts.
This SC-200 hotspot asks how to test a Defender for Cloud (Azure Security Center) logic app that should remediate security risks. It establishes that recommendation-triggered workflow automation is tested by manually triggering LA1 from the Recommendations blade, not from Security alerts.
Choosing Security alerts because LA1 is an automation and alerts feel operational; in Defender for Cloud, alerts represent threats, while the stated risks are recommendations.
Community Discussion (39 comments)
Anarckii
👍 1
2 and 3. They key wording in the question is "you need to test LA1 in Security Center" So we need to trigger is for testing
Leonit
👍 1
Im going with 2 and 3 beacuse we can creat a test security alerts. what about if we do not have any recomendation ? https://learn.microsoft.com/en-us/azure/defender-for-cloud/alert-validation?source=docs
b5aa736
👍 2
When an Azure Security Center Alert is created or triggered (correct answer) (Why?)This is the proper trigger if you want your Logic App to run automatically when a security alert is generated. You can also use a recommendation-based trigger for posture management, but alerts are more actionable for remediation. Workflow automation (correct answer) (Why?)You must configure workflow automation in Microsoft Defender for Cloud to run a Logic App (like LA1) automatically in response to an alert or recommendation.
OneplusOne
👍 1
On second thought, risks are not alerts. So; Trigger the logic app on recommendations and test it by creating a custom recommendation (option 1 / option 1)
OneplusOne
👍 1
Option 2 Option 3 You can create a sample alert of a security alert in Defender for Cloud: https://learn.microsoft.com/en-us/azure/defender-for-cloud/alert-validation#generate-sample-security-alerts
OneplusOne
👍 1
Correction Option 2 and Option 2
HAjouz
👍 1
If you review the docs - where it says Manually trigger a logic app -> you see trigger logic is under security alerts
cdgdhj
👍 4
what's the final answer?
talosDevbot
👍 3
"When an Azure Security Center Recommendation is created or triggered" "Recommendations" Important part of the question: "You need to test LA1 in Security Center" To test a Logic app, you want to manually trigger the app. To do this, you go to Recommendations > open a recommendation > select "Trigger a logic app" https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation#manually-trigger-a-logic-app
dyavlito
👍 1
The given anwser is correct: To test the Azure Logic App (LA1) in Security Center, you should configure the following options: Set the LA1 trigger to: When an Azure Security Center alert is created or triggered Trigger the execution of LA1 from: Workflow automation This setup will allow LA1 to be automatically triggered when a security alert is created or triggered in Azure Security Center, and you can test its functionality through the workflow automation feature.
g_man_rap
👍 1
Second. Second. Why Not "Recommendations"? If you select "When an Azure Security Center Recommendation is created or triggered," the Logic App would run whenever a recommendation is generated. However, since recommendations are not active threats but rather suggestions, this would not align with the objective of remediating actual security risks.
ostralo
👍 3
1. security risks - Security recommendations IMO, security threats are for Security Alert 2. Manually trigger a logic app You can also run logic apps manually when viewing any security alert or recommendation. To manually run a logic app, open an alert, or a recommendation and select Trigger logic app. We set the LA to be triggered by Security Recommendation that means we can manually trigger it via the Security Recommendation.
smanzana
👍 2
1. When an Azure Security Centre Recommendation is created or triggered 2. Security Alerts
blacksheep_29
👍 2
My opinion is for LA1 to trigger should be based on the Alert and Proof is below - logicAppResourceId": { "type": "String", "metadata": { "displayName": "Logic App", "description": "The Logic App that is triggered.", "strongType": "Microsoft.Logic/workflows", "assignPermissions": true } }, "logicAppTrigger": { "type": "String", "metadata": { "displayName": "Logic app trigger", "description": "The trigger connector of the logic app that is triggered. Possible values: 'Manual (Incoming HTTP request)', 'When an Azure Security Center Alert is created or triggered'." The above mentioned is the code for Logic App config which is set to trigger when an Azure Security alert is created or triggered. Correct me If I'm wrong
chepeerick
👍 1
check answer
cris_exam
👍 4
Based on this below article about a similar lab this lad did, I think the answer is: 1. When an Azure Security Centre Recommendation is created or triggered 2. Security Alerts https://security.packt.com/setting-up-automated-threat-response-in-microsoft-defender-for-cloud-azure-security-center/ Open for debate though...
donathon
👍 1
https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation#create-a-logic-app-and-define-when-it-should-automatically-run trigger based on alerts and workspace automation
billo79152718
👍 1
First one is correct. Second is: Security Alerts
mimguy
👍 4
On the exam July 7 2023
AK4U_111
👍 1
be careful not to mistake with Question #39
tatendazw
👍 1
Trigger is Security alert because of security risk. Workflow automation used to response to a security risk/incident https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation#create-a-logic-app-and-define-when-it-should-automatically-run
Apocalypse03
👍 3
To set the trigger for the logic app to be triggered by an alert from Azure Security Center, you should select the "When an alert is generated" trigger. This trigger will allow the logic app to be triggered when an alert is generated in Azure Security Center. Option 1, "When an Azure Security Centre Recommendation is created or triggered," is not a valid trigger. Recommendations are suggestions for remediation or improvement that are provided by Azure Security Center, but they do not trigger the execution of a logic app. Option 2, "When an Azure Security Centre is created or triggered," is also not a valid trigger. Azure Security Center is a service, not an entity that can be created or triggered. Option 3, "When a response to an Azure Security Center alert is triggered," is also not a valid trigger. Responses to alerts are actions taken in response to an alert, such as acknowledging or dismissing the alert. They do not trigger the execution of a logic app.
ACSC
👍 6
When an Azure Security Center Recommendation is created or triggered Recommendations
Whatsamattr81
👍 12
"automatically remediate security risks detected" - risks is the key word, that (to me) assumes the recommendations - and not alerts (which would be incidents). And it would be triggered on recommendations.
thinkingface
👍 3
https://docs.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation#create-a-logic-app-and-define-when-it-should-automatically-run . if you look at the 2nd or 3rd paragraph it says Logic apps can trigger from security alerts, doesn't mention workflow automation in that statement.
amsioso
👍 2
The logic app designer supports the following Defender for Cloud triggers: -When a Microsoft Defender for Cloud Recommendation is created or triggered -When a Defender for Cloud Alert is created or triggered -When a Defender for Cloud regulatory compliance assessment is created or triggered Note: If you are using the legacy trigger "When a response to a Microsoft Defender for Cloud alert is triggered", your logic apps will not be launched by the Workflow Automation feature. Instead, use either of the triggers mentioned above.
amsioso
👍 3
"security risks detected" not alerts, incidents... go with recommendations.
Lion007
👍 1
Agreeing with this answer, and add to it that you can actually find the "Trigger logic app" when you open both "Security alerts" and "Recommendations". This is mentioned in the docs page "To manually run a Logic App, open an alert or a recommendation and click Trigger Logic App:" https://docs.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation#manually-trigger-a-logic-app
Ken88
👍 3
Answer is correct.
Ramye
👍 2
How do you decipher/conclude the answer is recommendation from this link?
Banzaaai
👍 29
passed exam 31-Jan-2022, and answer Workflow Automation was not on exam... so.. I have chosen : Security Alerts
Nikki0222
👍 1
CORRECT
emartiy
👍 2
Since Workflow was newly added... There was also Security Alerts option in your exam. Newly added opttion is worng. So recommendations option is strongly true if it was an option in your exam :=) I got copilot to answer this and shared result in my comment for first select first option for second select first option.
AnonymousJhb
👍 3
Automate responses to Microsoft Defender for Cloud triggers using workflow automation - the trigger conditions selected is “Security alert” https://docs.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation
Tracebuster
👍 11
This is why I would go with Recommendation as the 2nd answer option https://docs.microsoft.com/en-us/azure/azure-monitor/reference/tables/securitynestedrecommendation
CatoFong
👍 3
this is correct
kornjaca
👍 3
There are both offered answers in the Add workflow automation creation wizard, so "When an Azure Security Center Recommendation is created or triggered" as well as "When an Azure Security Center alert is triggered". I can't find anything in the question that would imply one or another answer.
Jos8
👍 21
I think that the answer is "When an Azure Security Center Recommendation is created or triggered" because you want to remediate RISKS, not alerts.
karlEzio
👍 1
Correct
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The stem says LA1 will remediate security risks detected in Azure Security Center, and Defender for Cloud models risks as security recommendations, while alerts are used for threats and incidents. Workflow automation supports both recommendation-created and alert-created triggers, so the trigger must match the stated risk scenario: When an Azure Security Center Recommendation is created or triggered. To test LA1 in Security Center, you open a recommendation and use Trigger logic app, so the second selection is Recommendations. This aligns with Jos8's point that the goal is to "remediate RISKS, not alerts" and with ostralo's distinction that "security threats are for Security Alert." The manual test path also explains why the hotspot asks where you trigger the app, not just which trigger type you configure.Why Other Candidate Answers Are Wrong
Selecting When an Azure Security Center Alert is created or triggered would fit a threat-detection and incident-response playbook, but the question explicitly says risks, not threats. Likewise, testing from Security alerts would exercise the alert-triggered path and would not validate remediation of a recommendation-triggered workflow. A vote comment about a 2022 exam where Workflow Automation was absent does not change the product behavior being tested; the question still asks for the Security Center test location. Any answer that only changes the logic app trigger without using the recommendation's Trigger logic app command misses the "You need to test LA1 in Security Center" requirement.Community Comment Notes
Several learners split over whether "risks" points to recommendations or alerts. Jos8 and Whatsamattr81 emphasize that risks mean recommendations, while talosDevbot highlights that "To test a Logic app, you want to manually trigger the app" and points to Recommendations > Trigger a logic app. ostralo adds the useful distinction that "security threats are for Security Alert," reinforcing Recommendations for this risk-remediation scenario. One commenter reports passing with Security Alerts, but that anecdote conflicts with the question's risk wording and the manual recommendation test path.Official Reference
Exam Strategy
Anchor each hotspot dropdown to the exact noun in the stem: risks point to recommendations, threats point to alerts. Then recall the portal path used to test workflow automation, because the second dropdown tests operational knowledge rather than a definition.
Frequently Asked Questions
Why should LA1 be tested from Recommendations instead of Security alerts?
Because the stem says LA1 remediates security risks, and Defender for Cloud maps risks to recommendations; manually triggering from a recommendation validates that path.
Does 'When an Azure Security Center Recommendation is created or triggered' also cover manual testing?
Yes. With that workflow trigger configured, you can open a recommendation and select Trigger logic app to run LA1 manually for testing.
Related Analysis
Practice All SC-200 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-200 Practice Test →