Azure Cloud Security and Incident Response Automation GASAE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company wants to automatically respond to Azure Monitor alerts that indicate a storage account has been accessed from an unusual location. They want to revoke the storage account's access keys and rotate them. The solution must be serverless and event-driven. What should they implement?

   • AAn Azure Automation runbook that is scheduled to run every hour and checks for unusual access alerts.
   • BA Sentinel playbook that is triggered by the alert and uses the Azure Monitor connector to rotate the keys.
   • CAn Azure Function that is triggered by the Azure Monitor alert via a webhook and uses the storage management SDK to rotate the keys.
   • DAn Azure Policy that automatically rotates storage account keys when an alert is generated.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company runs a serverless application that processes security events. They need to automatically revoke a user's access in Azure AD when Azure Monitor detects a suspicious sign-in, and then log the action to a SIEM. The solution must minimize infrastructure management. What should they implement?

   • AA scheduled Azure Automation runbook that checks sign-in logs every hour and revokes access if needed.
   • BAn Azure Policy assignment that automatically disables the user account when a sign-in risk is detected.
   • CAn Azure Monitor alert that triggers an Azure Function, which calls Microsoft Graph to revoke the user's sessions and writes the audit log to Log Analytics.
   • DA Logic App that polls Azure Monitor alerts every minute and calls the Azure AD admin API to revoke access.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization wants to automatically respond to a specific Defender for Cloud recommendation (e.g., 'Vulnerabilities in container images should be remediated') by triggering a workflow that scans the image, patches it, and redeploys the container. They also want to notify the DevOps team. Which approach should they use?

   • AConfigure Azure Policy to automatically patch container images when a vulnerability is detected.
   • BCreate a Logic App that is triggered by the Defender for Cloud recommendation, runs a container scan, patches the image, and sends a notification to Teams.
   • CUse an Automation runbook that runs daily to scan and patch images.
   • DUse an Azure Monitor alert to trigger an Azure Function that patches the image and sends an email.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A government contractor must ensure that all Azure storage accounts in a subscription have TLS 1.2 enforced and are geo-redundant. They also want to be alerted if a non-compliant storage account is created. Which solution should they implement?

   • AUse Azure Monitor metrics to track TLS version and geo-redundancy settings, and create alerts based on those metrics.
   • BCreate an Azure Policy initiative that audits and denies non-compliant storage accounts, and enable Azure Security Center to generate alerts for policy violations.
   • CConfigure Azure Sentinel to collect activity logs and use a playbook to remediate non-compliant storage accounts after creation.
   • DDeploy an Azure Automation runbook that runs every hour to check storage accounts and send an email if any are non-compliant.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has a critical application that must be highly available. They want to monitor for specific performance metrics and automatically scale out the application when thresholds are exceeded. They also want to ensure that any scaling action is logged and auditable. Which solution should they implement?

   • AUse Azure Policy to automatically scale the application when metrics exceed thresholds.
   • BUse an Azure Function that is triggered by a metric alert and scales the application via API.
   • CUse an Azure Automation runbook that checks metrics every minute and scales the application manually.
   • DUse Azure Monitor autoscale settings with a rule that triggers on a metric, and configure diagnostic settings to send logs to a Log Analytics workspace.
   Reveal Solution Discussion Select an answer first