Azure Cloud Security and Incident Response Automation GASAE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In Azure Policy, what is the term for the JSON document that defines the conditions and the effect to apply when those conditions are met?

   • APolicy definition
   • BPolicy assignment
   • CInitiative definition
   • DCompliance report
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which Azure service provides a unified platform for collecting, analyzing, and acting on telemetry from your cloud and on-premises environments, including setting up alerts?

   • AAzure Security Center
   • BAzure Service Health
   • CAzure Monitor
   • DAzure Log Analytics
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team wants to automatically enrich Sentinel incidents with threat intelligence from an external threat feed. When an incident is created, they want to look up the involved IP addresses in the threat feed and add the results as comments to the incident. The solution must be serverless and event-driven. What should they implement?

   • AAn Azure Function that is triggered by a blob upload of incident data and then updates Sentinel.
   • BAn Azure Automation runbook that is triggered by a schedule and queries Sentinel incidents for the last hour.
   • CAn Azure Policy that automatically adds threat intelligence comments to Sentinel incidents.
   • DA Sentinel playbook that uses a Logic App HTTP connector to query the threat feed and then adds comments to the incident.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which Azure service allows you to create and run PowerShell or Python scripts, called runbooks, to automate administrative tasks such as security remediation?

   • AAzure Functions
   • BAzure Automation
   • CAzure Logic Apps
   • DAzure DevOps
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company wants to monitor Azure resources for unusual activity and automatically respond to specific alerts by restarting a VM or scaling out an App Service. They also need to keep a record of all actions taken. Which combination should they use?

   • AAzure Monitor alerts that trigger an Automation runbook for remediation and log the action to a Log Analytics workspace.
   • BAzure Security Center alerts that trigger a Logic App to restart the VM and send an email.
   • CAzure Policy that automatically restarts VMs when they are non-compliant.
   • DAzure Monitor metrics that trigger an Azure Function to scale out and write to a storage table.
   Reveal Solution Discussion Select an answer first