Design security operations, identity, and compliance capabilities →hardMultiple ChoiceObjective-mapped

SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Exhibit

{
  "type": "Microsoft.Security/automations",
  "apiVersion": "2021-01-01-preview",
  "properties": {
    "description": "Automation to isolate compromised devices",
    "sources": [
      {
        "eventSource": "Assessments",
        "ruleSets": [
          {
            "rules": [
              {
                "propertyJPath": "properties.metadata.severity",
                "operator": "Equals",
                "expectedValue": "High"
              }
            ]
          }
        ]
      }
    ],
    "actions": [
      {
        "type": "EventHub",
        "actionConfiguration": {
          "eventHubResourceId": "/subscriptions/.../resourceGroups/.../providers/Microsoft.EventHub/namespaces/.../eventhubs/...",
          "connectionString": "..."
        }
      }
    ]
  }
}

Refer to the exhibit. You are reviewing a Microsoft Defender for Cloud automation resource. You want the automation to trigger a playbook in Microsoft Sentinel when a high-severity security assessment is found. Based on the exhibit, what is the missing configuration?

⚠ Common exam trap

The trap here is that candidates may focus on the severity filter or event source, overlooking that the action type must be specifically 'LogicApp' to invoke a playbook, as 'EventHub' is a valid action but for a different purpose.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The action type should be 'LogicApp' instead of 'EventHub'

Microsoft Defender for Cloud automation can trigger a playbook in Microsoft Sentinel only by using a LogicApp action. The exhibit shows an EventHub action type, which is used for streaming events to an event hub, not for invoking a playbook. To trigger a Sentinel playbook from a Defender for Cloud assessment, the action type must be set to 'LogicApp' and configured with the playbook's trigger URL.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The severity filter should be 'Low' to capture all assessments
Why it's wrong here
The automation rule's severity filter currently restricts triggers to assessments classified as High, which aligns with the stated requirement to address only high-severity security findings. Switching the filter to Low would cause every assessment, including informational and low-priority items, to invoke the playbook, increasing noise and cost without adding value. Therefore, the current High filter is correct and not the cause of the failure.
✓
The action type should be 'LogicApp' instead of 'EventHub'
Why this is correct
To invoke a playbook in Microsoft Defender for Cloud, the automation action must be of type 'LogicApp' and contain the playbook's callback URL, not 'EventHub'. An EventHub action simply exports the event to an event hub for ingestion by external systems, whereas LogicApp directly triggers the playbook's workflow. Because the requirement is to run a playbook, the action type is the misconfigured property, and correcting it from EventHub to LogicApp is the necessary fix.
✗
The eventSource should be 'Alerts' instead of 'Assessments'
Why it's wrong here
The eventSource 'Assessments' is correct because security assessments represent the compliance and vulnerability findings that the playbook is designed to act upon. Changing it to 'Alerts' would narrow the trigger to active security alerts (e.g., detected attacks), which do not include the assessment-generated recommendation data. Since the goal is to act on assessments, the current eventSource is not the problem, and altering it would break the automation for the intended use case.
✗
The API version should be '2020-01-01'
Why it's wrong here
The API version '2020-01-01' is a valid and stable version for configuring automation rules and does not influence whether the action type can invoke a playbook. Even if a newer API version were used, the action type property would still be 'EventHub', leading to the same failure. The root cause is the action type itself, not the API version, so changing the API version would not resolve the issue.

Go deeper

SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question