mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: A company uses Microsoft Defender for Cloud to…
A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to ensure that critical recommendations are automatically remediated. They create a workflow automation that triggers a Logic App for specific recommendations. However, the Logic App fails to run. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often assume the trigger itself is failing due to a misconfiguration in Defender for Cloud, when in fact the trigger succeeds and the failure is in the Logic App's downstream action due to missing RBAC permissions on the managed identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The managed identity of the Logic App lacks permissions on the target resources.
The most likely cause is that the Logic App's managed identity lacks the necessary permissions on the target Azure resources. Workflow automations in Defender for Cloud use a Logic App that executes remediation actions; if the Logic App's identity (either system-assigned or user-assigned) does not have the required RBAC role (e.g., Contributor or a custom role with specific actions) on the resource scope, the remediation run will fail with an authorization error. This is a common misconfiguration because the automation trigger itself succeeds, but the downstream action fails due to insufficient permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The managed identity of the Logic App lacks permissions on the target resources.
Why this is correct
The Logic App invoked by the workflow automation uses a managed identity for authentication. If that identity has not been granted the required Azure RBAC role (e.g., Contributor) on the target resources—such as the affected VMs or databases—the remediation steps will fail when the automation triggers. This is the most common cause where the logic app runs but cannot perform the intended action because it lacks the necessary permissions.
- ✗
The subscription is not onboarded to Defender for Cloud.
Why it's wrong here
If the subscription were not onboarded to Microsoft Defender for Cloud, the service would not be able to assess resources at all, meaning no security recommendations would be generated. The workflow automation relies on these assessments to fire; without onboarding, there would be nothing to trigger. Since the organization is clearly seeing recommendations and attempting remediation, the subscription must already be onboarded, so this is not the cause of the automation failure.
- ✗
Defender for Cloud is disabled for the resource group.
Why it's wrong here
Defender for Cloud is a subscription-level security management service; there is no per-resource-group enable/disable toggle for the service itself. You can configure Defender plans and policies at the subscription or management group scope, but the resource group just contains resources that inherit those settings. Therefore, disabling Defender for Cloud for a resource group is not a valid operation, so it cannot explain why the automation is not triggering.
- ✗
The recommendation is disabled in the security policy.
Why it's wrong here
If a specific recommendation were disabled in the security policy (by setting a parameter to 'Disabled'), the continuous assessment would stop computing that recommendation's results. Consequently, the recommendation would no longer appear in the portal or generate the alerts/events that trigger workflow automation. Since the recommendation is still being assessed and visible, its policy is evidently enabled, so this cannot be the reason the automation fails to trigger.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.