Azure Cloud Security and Incident Response Automation GASAE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team wants to automate the process of revoking access to a compromised user account in Azure AD and resetting their password. They want this to happen automatically when a Sentinel incident is created for a compromised account. They also want to store the new password in Key Vault. Which service should they use to orchestrate this workflow?

   • AA Sentinel playbook that uses Logic Apps to call Azure AD connectors to revoke sessions and reset the password, then stores the new password in Key Vault.
   • BAn Azure Policy that automatically revokes access and resets passwords when a Sentinel incident is created.
   • CAn Azure Function that is triggered by a blob upload of incident data and performs the actions.
   • DAn Azure Automation runbook that is scheduled to run every hour and checks for Sentinel incidents.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A cloud governance team wants to automatically prevent the creation of storage accounts that do not have encryption enabled. When a non-compliant storage account is created, they want it to be automatically remediated. Which Azure Policy configuration should they use?

   • AA custom policy definition with effect 'Deny' that blocks creation of storage accounts without encryption.
   • BAn Azure Automation runbook that runs every hour to find storage accounts without encryption and enables it.
   • CAn Azure Policy initiative that only audits storage accounts for encryption and sends an alert to the security team.
   • DA built-in policy definition with effect 'DeployIfNotExists' that enables encryption on storage accounts and assigns it with a remediation task.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A development team wants to enforce security scanning in their Azure DevOps CI/CD pipeline. They want to scan infrastructure-as-code templates for misconfigurations and also scan the application code for vulnerabilities. They want to fail the pipeline if any high-severity issues are found. They also want to ensure that secrets are not stored in the pipeline variables. Which approach should they take?

   • AUse Azure Security Center to scan the pipeline code and fail the pipeline on high-severity findings.
   • BAdd a single pipeline task that runs Azure Policy to scan the code and infrastructure templates.
   • CAdd a pipeline task that runs a static analysis tool for infrastructure-as-code and a separate task for application code scanning, and store secrets in Azure Key Vault linked to the pipeline.
   • DStore secrets in pipeline variables and use a secret scanning tool to detect them in the code.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company has a hybrid infrastructure with on-premises servers that are not Azure Arc-enabled. They want to automate the remediation of a security misconfiguration on these servers using Azure Automation. What must they deploy to run the runbook against the on-premises servers?

   • AAn Azure Policy assignment with a DeployIfNotExists effect that targets the on-premises servers.
   • BA Hybrid Runbook Worker on an on-premises machine that can execute the runbook locally.
   • CA Sentinel playbook that uses the on-premises server as a data connector.
   • DAn Azure Function with a hybrid connection to the on-premises network.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which Azure service allows you to run event-driven code without provisioning or managing servers, making it suitable for security automation tasks like parsing logs or enriching alerts?

   • AAzure Logic Apps
   • BAzure App Service
   • CAzure Virtual Machines
   • DAzure Functions
   Reveal Solution Discussion Select an answer first