Automated Detection and Response GCTD Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team is ingesting logs from multiple sources into a SIEM. They notice that some logs have inconsistent timestamps (e.g., some are in UTC, some in local time, some with different formats). This is causing detection rules to miss events that occur around the time boundary. Which approach is most effective to address this issue?

   • AIgnore the timestamp inconsistencies and rely on the SIEM's default timezone setting.
   • BManually correct the timestamps in the raw logs before ingestion.
   • CWrite detection rules that account for the different timezones by using timezone-specific queries.
   • DConfigure the SIEM to normalize all timestamps to a single timezone (e.g., UTC) during ingestion.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which query language is commonly used for writing detection rules in Azure Sentinel?

   • AKQL (Kusto Query Language)
   • BPython
   • CSQL
   • DSigma
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of automated detection in cloud environments?

   • ATo continuously monitor and identify potential threats with minimal manual intervention
   • BTo eliminate the need for human security analysts
   • CTo guarantee that no security incidents will occur
   • DTo replace all manual security processes with automated ones
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company uses Microsoft Sentinel with a SOAR platform. They want to automatically isolate a compromised Azure VM when a high-severity alert fires, but only after a security analyst approves the action. The isolation must be reversible and logged. Which configuration best meets these requirements?

   • AConfigure an automation rule that immediately runs the isolation action without any approval step.
   • BUse a playbook that isolates the VM and then sends a notification to the analyst after the fact.
   • CCreate a playbook that triggers on the alert, sends an approval request to the analyst, and only runs the isolation action after approval, with all steps logged.
   • DSet up a manual runbook that the analyst must execute after reviewing the alert, with no automation.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company uses Microsoft Sentinel and Azure Logic Apps for automated response. They have a playbook that isolates a VM when a critical alert fires. During a recent incident, the playbook failed because the Logic App's managed identity did not have permission to execute the isolation action on the VM. The team needs to fix this quickly and ensure future reliability. Which action is most appropriate?

   • AChange the playbook to use a service principal with broader permissions, such as Contributor at the subscription level.
   • BGrant the Logic App's managed identity the necessary role (e.g., Virtual Machine Contributor) on the target VM or resource group, and test the playbook with a simulated alert.
   • CModify the alert rule to not trigger the playbook until permissions are fixed.
   • DDisable the playbook and manually isolate VMs in the future.
   Reveal Solution Discussion Select an answer first