CCSP Cloud Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Azure Policy

  Why this is correct

  Azure Policy evaluates resources against built-in or custom definitions and, through remediation tasks, automatically corrects non-compliant resources using managed identities. This directly satisfies the requirement for automated remediation in Azure, unlike monitoring or advisory services that only detect and report drift without enforcing configuration changes.

• ✗

  Azure Security Center

  Why it's wrong here

  Azure Security Center (now Microsoft Defender for Cloud) assesses posture and raises recommendations, but remediation tasks are created and executed through Azure Policy, not Security Center itself. It would be the answer where the requirement is continuous compliance assessment and secure score reporting rather than automated correction.

• ✗

  Azure Automation

  Why it's wrong here

  Azure Automation runs runbooks and update or configuration jobs, yet remediation tasks for non-compliant resources are defined and deployed by Azure Policy's remediation capability. Automation would be the choice for scheduled patching, process orchestration or configuration drift scripts outside policy enforcement.

• ✗

  Azure Logic Apps

  Why it's wrong here

  Logic Apps orchestrates workflows and connectors but does not evaluate resources against policy definitions, so it cannot itself determine non-compliance or create policy remediation tasks. It would be correct for triggering notifications or custom multi-system workflows after a compliance event is detected elsewhere.