Your security team wants the following automation: when Microsoft Defender for Cloud raises a High‑severity alert, open a ServiceNow incident and email the SOC; when a specific recommendation that supports policy remediation appears, automatically start a remediation task. What should you configure?

The correct answer leverages Azure Logic Apps and Defender for Cloud workflow automation. Logic Apps provide the orchestration engine to connect to ServiceNow, send emails, and initiate Azure Policy remediation tasks. Defender for Cloud's workflow automation rules are crucial for triggering these Logic Apps based on specific conditions: High-severity alerts and specific recommendations. This direct integration ensures the automation runs precisely when needed. Incorrect options: Azure Automation Update Management is for patching and update compliance, not security alerts or policy remediation. Azure Functions with Event Grid for resource health events is too broad and doesn't directly address Defender for Cloud alerts or policy remediation. Activity Log alerts monitor control plane operations, not security alerts from Defender for Cloud or policy recommendations. A Microsoft Sentinel playbook with a Sentinel alert trigger would require all Defender for Cloud alerts to be ingested into Sentinel first, adding unnecessary complexity and cost for this specific requirement. While Sentinel can integrate, Defender for Cloud's native workflow automation is more direct for this scenario.