Azure Cloud Security and Incident Response Automation GASAE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   You need to run a PowerShell script that automatically remediates a security misconfiguration on a VM. Which Azure Automation feature is designed for this purpose?

   • AUpdate Management
   • BRunbook
   • CDesired State Configuration (DSC)
   • DChange Tracking
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In Azure Monitor, what is the name of the resource that defines the condition that triggers a notification or action when a metric crosses a threshold?

   • AWorkbook
   • BAction group
   • CMetric
   • DAlert rule
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which Azure service is designed to securely store and manage secrets, keys, and certificates, and can be used to automate secret rotation?

   • AAzure Security Center
   • BAzure Key Vault
   • CAzure Confidential Ledger
   • DAzure App Configuration
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security operations center (SOC) uses Microsoft Sentinel. They receive a high volume of low-fidelity alerts. They want to automatically suppress alerts that are not associated with active threat intelligence indicators, while still creating incidents for alerts that match known indicators. They also want to avoid unnecessary playbook executions. What is the most efficient approach?

   • AUse an analytics rule with a threat intelligence match and set the alert suppression window for low-fidelity alerts.
   • BConfigure Azure Policy to automatically suppress Sentinel alerts that do not match threat intelligence.
   • CCreate a playbook that runs on every alert and checks threat intelligence before deciding to create an incident.
   • DUse an Azure Function to periodically query Sentinel alerts and delete those that do not match threat intelligence.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security operations team uses Microsoft Sentinel to triage phishing incidents. They want an automated workflow that, when a phishing incident is created, quarantines the reported email message, blocks the sender in Microsoft 365, and posts a message to a Teams channel. The workflow must use only built-in connectors and must not require custom code. What should the team implement?

   • AAn Azure Automation runbook that is scheduled every five minutes to query Sentinel incidents and perform the remediation actions.
   • BA PowerShell script run manually from the analyst's workstation that uses the Microsoft Graph API to perform all the required actions.
   • CAn Azure Policy initiative that assigns a custom policy to automatically quarantine emails and block senders when a phishing incident is detected.
   • DA Sentinel playbook that starts with an incident trigger and uses Logic Apps actions for email quarantine, sender block, and Teams posting.
   Reveal Solution Discussion Select an answer first