Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Security Operations Analyst Associate · Microsoft
Drag & Drop Scenario
Read the scenario requirements and decide your answer. Click Check Answer below to see the marked solution.
Hotspot Solution:
The correct answer is: - Step1: Create a Logic app (this will a part of process of creating a workflow automation), the logic app will use "Defender for cloud alert is triggered" as a trigger. The logic app will have a an action item to send email notifications. When the workflow automation in step2 will run, it will automatically run this logic app. - Step2: Create a workflow automation & use "Security alert" as the cloud data type. This will make sure that this workflow automation will run whenever there is a security alert generated. In the action option "select the logic app" created in Step1. If you do not create the logic app in step1, then it will NOT be shown in the workflow automation page. - Step3: From the Security alerts in MDC, create a sample alert. There is a sample alert for "digital currency mining". Once the sample security alert is created, it will trigger the workflow automation & the workflow automation will trigger the logic app. The logic app will send the email. This is how you do it in real world.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
1) From Logic App Designer, create a logic app. 2) From Workflow automation in Defender for Cloud, add a workflow automation 3) From Security alerts in Defender for Cloud, create a sample alert How are you supposed to add the workflow automation if you don’t have the logic app created yet? That’s why creating the logic app is the first step.
this is valid for me. You need de logic app create a automation in Defender the worflow to be sure you need to test with a test alert. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alert-validation?source=docs
- From Workflow Automation in Defender for Cloud, add a workflow automation: [(This step links a trigger (like a specific alert) to an action (like sending an email via a Logic App).] - From Logic App Designer, create a logic app: [This logic app defines the actual workflow, such as sending an email when triggered by the alert]. - From Security alerts in Defender for Cloud, create a sample alert. [This allows you to test the automation and confirm that the email notification is triggered correctly]. ----------------------------------------------------------------------------------------------------------------------------------- Step-by-Step Breakdown: Create Workflow Automation in Defender for Cloud Define the alert type (e.g., digital currency mining) and link it to a Logic App. Create Logic App in Logic App Designer Design the workflow to send an email when triggered by the alert. Trigger Sample Alert from Defender for Cloud Use the built-in test alert feature to simulate the alert and verify that the email notification is sent.