A security team wants to enrich Sentinel incidents with threat intelligence from Microsoft Defender Threat Intelligence and automatically block malicious IPs in Azure Firewall. They also want to send a notification to the SOC channel in Microsoft Teams. Which solution should they implement?

Deploy an Azure Automation runbook that periodically pulls threat intelligence and updates firewall rules, then emails the SOC.

Use Azure Policy to automatically add the malicious IPs to Azure Firewall based on threat intelligence data.

Configure an Azure Monitor alert to trigger a Logic App that enriches the incident and blocks the IP.

Create a Sentinel playbook that uses the Threat Intelligence connector to enrich the incident, then calls an Azure Function to update Azure Firewall rules and posts a message to Teams.

A company wants to automatically rotate the client secret for an Azure AD application every 60 days. The rotation must be performed by an Azure Function and the new secret must be stored in Key Vault. The function must be able to update the application secret and write to Key Vault without storing any credentials in the function's configuration. What should they use to authenticate the function?

A managed identity assigned to the Azure Function with permissions to update the Azure AD application and write to Key Vault.

A connection string to Key Vault stored in the function's code.

A certificate installed on the function's host machine.

A service principal with a client secret stored in the function's application settings.

GIAC AI Security Automation Engineer

Domain 2Objective 2

Azure Cloud Security and Incident Response Automation GASAE Practice Questions (Page 8)

Part of the Cloud Security Automation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 8–13 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

10concepts

Questions 36–40

36application · medium
A security team wants to enrich Sentinel incidents with threat intelligence from Microsoft Defender Threat Intelligence and automatically block malicious IPs in Azure Firewall. They also want to send a notification to the SOC channel in Microsoft Teams. Which solution should they implement?
Select an answer first
37foundation · easy
Which Azure service provides a low-code visual designer to create automated workflows that can integrate with various systems, including security tools?
Select an answer first
38application · medium
A company wants to automatically rotate the client secret for an Azure AD application every 60 days. The rotation must be performed by an Azure Function and the new secret must be stored in Key Vault. The function must be able to update the application secret and write to Key Vault without storing any credentials in the function's configuration. What should they use to authenticate the function?
Select an answer first
39foundation · easy
In Microsoft Defender for Cloud (formerly Azure Security Center), which feature allows you to define automated responses to security alerts and recommendations, such as sending an email to a security admin or creating a ticket in an external system?
Select an answer first
40foundation · easy
In an Azure Logic App workflow, what is the term for the element that starts the workflow when a specific event occurs, such as receiving an email or an HTTP request?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASAE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASAE” is a trademark of its owner, used for identification only.

Azure Cloud Security and Incident Response Automation GASAE Practice Questions (Page 8)

Questions 36–40

A security team wants to enrich Sentinel incidents with threat intelligence from Microsoft Defender Threat Intelligence and automatically block malicious IPs in Azure Firewall. They also want to send a notification to the SOC channel in Microsoft Teams. Which solution should they implement?

Which Azure service provides a low-code visual designer to create automated workflows that can integrate with various systems, including security tools?

In Microsoft Defender for Cloud (formerly Azure Security Center), which feature allows you to define automated responses to security alerts and recommendations, such as sending an email to a security admin or creating a ticket in an external system?

In an Azure Logic App workflow, what is the term for the element that starts the workflow when a specific event occurs, such as receiving an email or an HTTP request?

Keep studying — Cloud Security Automation