Azure Cloud Security and Incident Response Automation GASAE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team wants to automate the response to Azure Monitor alerts that indicate a user has signed in from an impossible travel location. They want to disable the user's account in Azure AD and send a notification to the security team. Which service should they use to orchestrate these actions?

   • AAn Azure Automation runbook that is scheduled to run every hour and queries Azure AD for impossible travel events.
   • BAn Azure Policy that automatically disables a user when an impossible travel alert is generated.
   • CAn Azure Logic App that is triggered by the Azure Monitor alert and uses Azure AD connectors to disable the user and send an email.
   • DAn Azure Function that is triggered by a blob upload of alert data and disables the user.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A DevOps team wants to integrate security testing into their CI/CD pipeline. They need to scan infrastructure-as-code templates for misconfigurations, validate that secrets are not hardcoded, and ensure that the deployment uses the latest approved versions of third-party libraries. They also want to fail the pipeline if any critical issue is found. Which solution should they implement?

   • AAdd pipeline tasks that run a static analysis tool for IaC, a secret scanner, and a dependency checker, and configure the pipeline to fail on critical findings.
   • BUse a Sentinel playbook to scan the code and block the deployment if issues are found.
   • CUse an Azure Automation runbook to scan the code after deployment and send a report.
   • DUse Azure Policy to scan the templates after deployment and remediate any issues.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team wants to automate the response to a specific type of alert from Microsoft Defender for Identity (e.g., suspicious Kerberos activity). They want to automatically isolate the affected user account, reset the password, and notify the user's manager. They also need to ensure that the response is reversible if it was a false positive. Which solution should they implement?

   • AUse an Azure Policy that automatically disables accounts when suspicious activity is detected.
   • BUse an Azure Automation runbook that immediately disables the account and resets the password without approval.
   • CUse an Azure Function that disables the account and resets the password, but does not notify the manager.
   • DCreate a Sentinel playbook that triggers on the alert, disables the account, resets the password, and sends an email to the manager, with a manual approval step before disabling.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company wants to automate the detection and response to data exfiltration attempts from Azure Blob Storage. They want to monitor for unusual download patterns, automatically block the user's access if a threshold is exceeded, and log the event for compliance. They also want to minimize the time between detection and response. Which solution should they implement?

   • AUse Azure Policy to automatically block users based on download patterns.
   • BUse an Azure Automation runbook that runs every hour to analyze logs and block users.
   • CUse Azure Monitor alerts on storage metrics to trigger an Azure Function that blocks the user via Microsoft Graph and logs to Log Analytics.
   • DUse a Sentinel playbook that triggers on a scheduled query and blocks the user.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   You want to automatically run a security vulnerability scan on your code every time a developer pushes to the main branch. Which Azure DevOps component should you use to define this automated process?

   • AAgent pool
   • BRelease pipeline
   • CService connection
   • DBuild pipeline
   Reveal Solution Discussion Select an answer first