How Do You Email Defender for Cloud Digital Currency Mining Alerts?
Answer
Create the Logic App, add a Defender for Cloud workflow automation that triggers it for digital currency mining alerts, then run the Logic App trigger to send the test email.
DRAG DROP You have an Azure subscription. The subscription contains 10 virtual machines that are onboarded to Microsoft Defender for Cloud. You need to ensure that when Defender for Cloud detects digital currency mining behavior on a virtual machine, you receive an email notification. The solution must generate a test email. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place: [sampleXML/xmlfile-87_1.jpg]
Community Insight
Tests the dependency order inside Defender for Cloud workflow automation — the Logic App must exist before a workflow automation rule can reference it, and only running the trigger actually emits the test email.
Defender for Cloud workflow automation routes an alert to a Logic App, whose send-email action produces the notification. This page confirms the three-step order: create the Logic App, add the workflow automation that filters digital currency mining alerts, then run the Logic App trigger to generate the test email.
Putting the test step first: triggering a Logic App (or raising a sample alert) before the workflow automation is attached proves nothing, because no rule yet routes the digital currency mining alert to the Logic App.
Community Discussion (27 comments)
f90c339
👍 2
1) From Logic App Designer, create a logic app. 2) From Workflow automation in Defender for Cloud, add a workflow automation 3) From Security alerts in Defender for Cloud, create a sample alert How are you supposed to add the workflow automation if you don’t have the logic app created yet? That’s why creating the logic app is the first step.
Leonit
👍 1
this is valid for me. You need de logic app create a automation in Defender the worflow to be sure you need to test with a test alert. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alert-validation?source=docs
sdbol
👍 1
- From Workflow Automation in Defender for Cloud, add a workflow automation: [(This step links a trigger (like a specific alert) to an action (like sending an email via a Logic App).] - From Logic App Designer, create a logic app: [This logic app defines the actual workflow, such as sending an email when triggered by the alert]. - From Security alerts in Defender for Cloud, create a sample alert. [This allows you to test the automation and confirm that the email notification is triggered correctly]. ----------------------------------------------------------------------------------------------------------------------------------- Step-by-Step Breakdown: Create Workflow Automation in Defender for Cloud Define the alert type (e.g., digital currency mining) and link it to a Logic App. Create Logic App in Logic App Designer Design the workflow to send an email when triggered by the alert. Trigger Sample Alert from Defender for Cloud Use the built-in test alert feature to simulate the alert and verify that the email notification is sent.
Edindude
👍 3
- From Workflow automation in Defender for cloud, add workflow automation - From Logic App Designer, Create a logic App - From Security alerts in defender for Cloud, Create a sample alert From copilot - Seems valid
user636
👍 2
The correct answer is: - Step1: Create a Logic app (this will a part of process of creating a workflow automation), the logic app will use "Defender for cloud alert is triggered" as a trigger. The logic app will have a an action item to send email notifications. When the workflow automation in step2 will run, it will automatically run this logic app. - Step2: Create a workflow automation & use "Security alert" as the cloud data type. This will make sure that this workflow automation will run whenever there is a security alert generated. In the action option "select the logic app" created in Step1. If you do not create the logic app in step1, then it will NOT be shown in the workflow automation page. - Step3: From the Security alerts in MDC, create a sample alert. There is a sample alert for "digital currency mining". Once the sample security alert is created, it will trigger the workflow automation & the workflow automation will trigger the logic app. The logic app will send the email. This is how you do it in real world.
user636
👍 1
The answer is: Add workflow automation Create a logic app Create a sample alert. as explained in my other comment. The process in both comments will get the results in the real world. However as per Microsoft docs, start with workflow automation and then logic creation...
user636
👍 2
Keep it simple & don't overthink: You will first start with creating a workflow automation, during the process you will create a logic app as one of the step. In workflow automation you will define the Trigger conditions. You can use "alert name contains" to define digital currency mining as a trigger. During the logic app creation you will use send email as an action. Once the logic app is created, you will generate a sample alert, this will ensure/test that the workflow automation & logic app in use are both working fine. The answer is: Add workflow automation Create a logic app Create a sample alert. There is a sample alert for digital currency mining (ref: https://learn.microsoft.com/en-us/azure/defender-for-cloud/alert-validation)
OneplusOne
👍 1
Sample alert digital currency mining indeed exists: https://github.com/Azure/Microsoft-Defender-for-Cloud/blob/main/Labs/Modules/Module-6-Azure-Defender.md
Ramye
👍 4
See, you must have a Logic app available to be used for creating workflow automation steps, and you need to have an alert by a trigger for setting up the automation, therefore, the ans should be: - create the logic app - trigger the logic app to test - and finally, add the workflow automation
chepeerick
👍 1
Correct
NICKTON81
👍 2
The answer is correct! https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation
vdabhi123
👍 4
https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation Create a logic app and define when it should automatically run Manually trigger a logic app Configure workflow automation at scale using the supplied policies
Marchiano
👍 18
https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation Create a logic app and define when it should automatically run 1. From Defender for Cloud's sidebar, select Workflow automation. 2. To define a new workflow, select Add workflow automation. 3. From the Actions section, select visit the Logic Apps page to begin the logic app creation process. 4. Select (+) Add. 5. Fill out all required fields and select Review + Create. 6. Review the information you entered and select Create. 7. After you've defined your logic app, return to the workflow automation definition pane ("Add workflow automation"). Select Refresh to ensure your new logic app is available for selection. 8. Select your logic app and save the automation. The logic app dropdown only shows those with supporting Defender for Cloud connectors mentioned above. Given the above, the answer should be: 1. From Workflow automation in Defender for Cloud, add a workflow automation 2. From Logic App Designer, create a logic app 3. From Logic App Designer, run a trigger
kabooze
👍 2
yes, but nothing stops you from creating the logic app before creating the workflow automation. So technically it's -> create logic app -> create workflow automation -> run trigger
davidli
👍 2
This is very valid to me.
XLR8T2
👍 3
Estas son las respuestas correctas: 1. From Logic App Designer, create a logic App. -> Correcto: Primero necesitas que exista un LogicApp. 2. From Workflow automation in Defender for Cloud, add workflow automation. -> Correcto: agregar el Logic App antes creado. 3. From Security alerts in Defender for Cloud, create a sample alerta -> Correcto: Para realizar y probar que tu Logic App funciona.
imhere4you
👍 8
On exam - 19 June 2023
teouba
👍 5
If you trigger the app, before you create the workflow, then what's the point? The provided answer doesnt make any sense, first you need to create the workflow and then trigger the alert
JoeP1
👍 2
Running the trigger tests that the logic app sends the email properly, but does not test the workflow that runs the logic app.
ACSC
👍 7
Answer is correct. You should: create the logic app trigger the logic app to test and finally add the workflow automation,
HAjouz
👍 1
These steps align with the process described in the Microsoft documentation: Create a sample alert: This helps you test the workflow automation. Create a Logic App: This app will define the actions to take when an alert is triggered. Add a workflow automation: This links the Logic App to the specific alert, ensuring that the defined actions are executed when the alert is triggered.
Metasploit
👍 21
This solution does not meet the sequence specified in the question. The solution must generate a test email. Correct answer is: 1) Create logic app 2) Add workflow automation (specifies action - send email) 3) Trigger logic app (creates alert->workflow automation activates -> sends email)
Tuitor01
👍 1
https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules 1) First automation workflow 2) Crate your logicapp 3) Inside your logicapp designer pager nothing prevents you from testing the trigger
BieLey
👍 7
But don't you need to run a trigger before you should to the workflow automation?
Fukacz
👍 3
Correct. 1. Create Logic App 2. trigger (test) 3. apply
amsioso
👍 3
And what happend with "create a sample alert"??
Frankie21
👍 1
indeed that is the one you need to test it
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Defender for Cloud workflow automation is a three-link chain and the sequence follows the dependencies. The Logic App is the resource that actually holds the work — the Defender for Cloud alert trigger plus a send-email action — so it has to be created first, otherwise the workflow automation's Actions step has nothing to select. The workflow automation rule is the second link: it defines the scope and the condition (for example, alert name contains the digital currency mining detection) and points at the existing Logic App, which is what guarantees only mining behavior reaches the inbox. Running the Logic App trigger last is the only step that produces the deliverable the stem demands, a test email, because configuration steps alone never send mail — the run passes a sample alert payload into the flow and the send-email action fires.Why Other Candidate Answers Are Wrong
Sequences that trigger the Logic App before adding the workflow automation do send an email, but they float: nothing in that ordering ever proves the mining-alert condition is wired to the app, so the stated business requirement is untested. Starting at the Defender for Cloud workflow automation blade with no Logic App in place stalls at the Actions section, where an existing Logic App must be chosen. Substituting a sample alert for the trigger only works when the generated alert name matches your filter — Defender for Cloud sample alerts use generic names such as suspicious process activity, so a workflow scoped to digital currency mining will not fire and no test email appears. Options that swap the Logic App entirely, such as continuous export to a Log Analytics workspace or an action group, move or notify through a different pipeline and never deliver the requested email.Community Comment Notes
Metasploit, the highest-voted comment, rejects the posted ordering with the observation that "The solution must generate a test email" and then states "Correct answer is: 1) Create logic app 2) Add workflow automation" followed by triggering the app — the same dependency logic applied here. Ramye and teouba argue the inverse, that testing the Logic App should come before wiring the automation, which produces an email but never validates the mining-specific routing. Marchiano and vdabhi123 both anchor the discussion to Microsoft's workflow automation article, while Edindude and XLR8T2 propose creating a sample alert as the final step, a valid test only when the alert name satisfies the workflow condition.Official Reference
Exam Strategy
Order drag-and-drop automation items by dependency, not by what feels like testing: resource first (Logic App), rule that references it second (workflow automation), execution that yields the output last (run the trigger). Whenever the stem adds a 'must generate a test email' clause, the final action is the one that actually exercises the object.
Frequently Asked Questions
Does the Defender for Cloud workflow automation itself send the email?
No. The Logic App holds the send-email action; the workflow automation only decides when to invoke it, based on the alert name and severity conditions you configure.
Can I create a sample alert instead of running the Logic App trigger to test?
Only if the sample alert's name matches your workflow condition. Sample alerts use generic names, so a digital currency mining filter typically will not fire.
Related Analysis
Practice All SC-200 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-200 Practice Test →