Azure Cloud Security and Incident Response Automation GASAE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which Azure service is the underlying technology that Microsoft Sentinel playbooks are built upon?

   • AAzure Logic Apps
   • BAzure Functions
   • CAzure Data Factory
   • DAzure Automation
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which Azure DevOps feature allows you to define a series of steps that automatically build, test, and deploy code, and can include security scanning tasks?

   • APipeline
   • BWork item
   • CTest plan
   • DRepository
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A large enterprise must enforce a policy that all key vaults have soft-delete enabled. They also need to ensure that any key vault created without soft-delete is automatically corrected. The compliance team wants to see a continuous compliance report. They are using Azure DevOps for infrastructure deployment. Which approach best meets all requirements?

   • AUse an Azure Automation runbook that runs nightly to enable soft-delete on any key vault that lacks it and sends a report via email.
   • BUse Azure Security Center recommendations to identify key vaults without soft-delete and manually remediate them.
   • CCreate a custom Azure Policy with 'Deny' effect and rely on Azure DevOps pipeline gates to block non-compliant deployments.
   • DAssign a built-in Azure Policy with 'DeployIfNotExists' effect and a remediation task, and use Azure DevOps pipeline to generate compliance reports from Azure Policy.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which Azure service allows you to create, assign, and manage policies that enforce rules and effects on your resources to ensure compliance with corporate standards?

   • AAzure RBAC
   • BAzure Policy
   • CAzure Blueprints
   • DAzure Security Center
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security operations team uses Microsoft Sentinel to manage alerts. They want to automatically isolate a compromised Azure VM by adding an NSG rule, but only after an analyst approves the action in Teams. The team also needs the VM's admin credentials rotated automatically after isolation. Which approach should they use?

   • ADeploy an Azure Function that listens to Sentinel alerts, sends a Teams message, and waits for a manual email reply before isolating the VM.
   • BConfigure a Logic App triggered by a Sentinel alert that immediately adds the NSG rule and rotates the secret without any approval step.
   • CUse an Azure Policy initiative to automatically add the NSG rule and rotate the secret when a VM is marked compromised.
   • DCreate a Sentinel playbook that starts with a Teams approval step, then calls an Azure Automation runbook to add the NSG rule and rotate the Key Vault secret.
   Reveal Solution Discussion Select an answer first