Triggering Automated Responses from Defender for Storage
Short answer
A Configure an Azure Event Grid subscription to route Defender for Storage malware scan results to a serverless workflow.
Question
Sub1 has Microsoft Defender for Storage enabled. Defender for Storage has on-upload malware scanning enabled.
The security team at your company requires that all malicious files be processed automatically by a serverless workflow for quarantine and notification.
You need to ensure that the malware scan results trigger an automated response. The solution must minimize operational effort.
What should you configure?
Key Takeaways
The key is recognizing that Defender for Storage publishes real-time security events to Event Grid, which serves as the event bus for triggering Logic Apps or Functions.
This question tests how to trigger automated serverless workflows based on Microsoft Defender for Storage malware scan results. The correct solution uses Azure Event Grid to route events with minimal operational effort.
Common mistake: Many candidates choose Diagnostic Settings (B) because it is commonly used for log aggregation, but it introduces latency and higher operational overhead compared to Event Grid for real-time automation.
Expert Analysis
Why the Answer Is Correct
Microsoft Defender for Storage natively publishes detection events, including malware scan results, to Azure Event Grid. By configuring an Event Grid subscription, you can immediately route these events to serverless compute services like Azure Logic Apps or Azure Functions. This enables real-time processing for quarantine and notification tasks with minimal operational effort, aligning perfectly with the requirement.
Why the Other Options Are Wrong
Diagnostic settings (Option B) send logs to destinations like Log Analytics or Event Hubs, but they are not designed for real-time event-driven automation; they introduce latency and require more complex logic to parse logs. Lifecycle management policies (Option C) are used for data tiering and expiration, not security response. Azure Monitor alert rules (Option D) are typically used for metrics and thresholds rather than discrete event-based workflows for individual file scans.
Community Comment Notes
Community consensus strongly supports Option A, noting that "Microsoft Defender for Storage natively publishes real-time malware scan results directly to Azure Event Grid." One user highlighted that this approach allows routing to Logic Apps or Functions instantly. Another comment was irrelevant, discussing Virtual Network components, which does not apply to this storage security scenario.
Exam Strategy
When asked about automating responses to security detections in Azure, always consider Event Grid first as the primary event routing mechanism for serverless triggers.
Frequently Asked Questions
Why not use Diagnostic Settings for real-time alerts?
Can Logic Apps be triggered by Defender for Storage?
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
Eltooth 👍 2 Answered AA. an Azure Event Grid subscription. Microsoft Defender for Storage natively publishes real-time malware scan results directly to Azure Event Grid. Creating an Event Grid subscription allows you to immediately route those events to serverless compute options like Azure Logic Apps or Azure Functions. This triggers your quarantine and notification workflows instantly with absolute minimal operational effort.
-
AG_245466 👍 1 Answered BVirtual network Component VNet1 An Azure Private Link service VNet2 A private endpoint Why these are correct - VNet1 — Azure Private Link service: Exposes a service hosted behind VNet1 privately, allowing controlled access to the application resources without exposing them publicly. - VNet2 — Private endpoint: Lets VM3 connect privately to the service in VNet1 through a private IP address.
-
SchnitzelLicker 👍 1 Answered A. Diagnostic settings to Log Analytics: This stores scan results for querying and auditing. It doesn’t trigger a workflow by itself, and using it for automation would add query and alert latency.
-
Borman 👍 1It doesn't trigger, hence wrong. The Q asks for it straight: You need to ensure that the malware scan results trigger an automated response.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →