Azure Cloud Security and Incident Response Automation GASAE Practice Questions (Page 9)

Questions 41–42

1. 41foundation · easy

   In Microsoft Sentinel, what is the name of the component that contains the automated response workflow triggered by an analytics rule or incident?

   • AWorkbook
   • BHunting query
   • CPlaybook
   • DData connector
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A security team needs to automate the response to phishing emails reported by users. They want to use Microsoft Sentinel to collect the reports, enrich them with threat intelligence, and automatically disable the user's account if the URL is malicious. They also need to rotate the user's password in Key Vault. The solution must be cost-effective and not require always-on VMs. Which approach should they use?

   • AUse an Azure Policy initiative to automatically disable accounts when a phishing report is detected.
   • BUse a Sentinel playbook that triggers an Azure Function to check the URL against threat intelligence and, if malicious, disable the account and rotate the password in Key Vault.
   • CDeploy an Azure Automation runbook on a VM that polls Sentinel for new incidents and performs the actions.
   • DUse a Logic App that runs continuously to monitor for new incidents and perform the actions.
   Reveal Solution Discussion Select an answer first