A company has a hybrid environment with VMs in Azure and on-premises. They need to automate the remediation of a specific security misconfiguration (e.g., open management ports) across both environments. They also want to rotate the local admin password on affected VMs. Which solution should they use?

Use an Azure Automation runbook with a Hybrid Worker to run on-premises and in Azure, remediating the misconfiguration and rotating local admin passwords via Key Vault.

Use an Azure Function that runs in Azure and connects to on-premises VMs via VPN.

Use a Sentinel playbook that triggers an Automation runbook only for Azure VMs.

Use an Azure Policy initiative that applies to both Azure and on-premises VMs.

A security team receives a high volume of low-severity alerts from Microsoft Defender for Cloud. They want to automatically triage these alerts, enrich them with context from Key Vault (e.g., resource owner), and create a task in a ticketing system only if the alert is confirmed as a true positive. Which solution should they implement?

Create a Logic App that is triggered by Defender for Cloud alerts, enriches the alert using Key Vault data, and creates a ticket only if a condition is met.

Use an Azure Automation runbook that runs every hour to pull alerts, enrich them, and create tickets.

Use an Azure Function that is triggered by a timer to process alerts and create tickets.

Configure Sentinel to automatically create a ticket for every alert without enrichment.

GIAC AI Security Automation Engineer

Domain 2Objective 2

Azure Cloud Security and Incident Response Automation GASAE Practice Questions (Page 2)

Part of the Cloud Security Automation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 8–13 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

10concepts

Questions 6–10

6foundation · easy
Which Azure service is the primary integration target when you configure workflow automation in Microsoft Defender for Cloud to execute a custom response action?
Select an answer first
7foundation · easy
In Microsoft Sentinel, which feature allows you to bring in external threat intelligence feeds (such as indicators of compromise) to enrich alerts and automate responses?
Select an answer first
8foundation · easy
Which Microsoft security product provides a unified graph of entities and relationships (such as users, devices, and alerts) that can be queried to enrich automated security responses?
Select an answer first
9application · medium
A company has a hybrid environment with VMs in Azure and on-premises. They need to automate the remediation of a specific security misconfiguration (e.g., open management ports) across both environments. They also want to rotate the local admin password on affected VMs. Which solution should they use?
Select an answer first
10application · medium
A security team receives a high volume of low-severity alerts from Microsoft Defender for Cloud. They want to automatically triage these alerts, enrich them with context from Key Vault (e.g., resource owner), and create a task in a ticketing system only if the alert is confirmed as a true positive. Which solution should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASAE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASAE” is a trademark of its owner, used for identification only.

Azure Cloud Security and Incident Response Automation GASAE Practice Questions (Page 2)

Questions 6–10

Which Azure service is the primary integration target when you configure workflow automation in Microsoft Defender for Cloud to execute a custom response action?

In Microsoft Sentinel, which feature allows you to bring in external threat intelligence feeds (such as indicators of compromise) to enrich alerts and automate responses?

Which Microsoft security product provides a unified graph of entities and relationships (such as users, devices, and alerts) that can be queried to enrich automated security responses?

Keep studying — Cloud Security Automation