You have an Azure subscription. You plan to create a workflow automation in Azure Security Center that will automatically remediate a security vulnerability. What should you create first?

Question

Options

• Aa managed identity
• Ban automation account
• Can Azure function app
• Dan alert rule
• Ean Azure logic app

• A
  3% (1)
• B
  10% (3)
• D
  7% (2)
• E
  80% (24)

Explanation

Workflow Automation in Azure Security Center

An Azure Logic App (E) must be created first because workflow automation in Azure Security Center is built directly on Logic Apps as its execution engine - you select a Logic App as the trigger/action handler when configuring automation rules within Security Center to respond to security alerts or recommendations.

• A (Managed Identity) is incorrect because while a managed identity may be used to grant permissions, it is not the foundational component that drives the automated workflow itself.
• B (Automation Account) is incorrect because Automation Accounts are used for PowerShell runbooks and Azure Automation tasks, not for Security Center's native workflow automation feature.
• C (Azure Function App) is incorrect because although Function Apps can execute code, Security Center's workflow automation specifically integrates with Logic Apps, not Function Apps directly.
• D (Alert Rule) is incorrect because alert rules trigger notifications but are not the mechanism used to remediate vulnerabilities through workflow automation in Security Center.

Memory Tip: Think "Logic App = Logic for Security Center automation" - Security Center's workflow automation UI literally has a field that says "Logic App" when you configure it. If you see workflow automation + Security Center + remediation, always think Logic Apps first.

No community discussion yet for this question.