Azure Cloud Security and Incident Response Automation

GASAE · 20 questions

• A city deploys municipal landing-zone NSGs and diagnostic settings only through Bicep or Terraform pull requests. What Azure security practice is that?
• A county wants Azure Policy to deny public IP addresses on virtual machines in the courts resource group. What guardrail is that?
• A transit authority templates private endpoints for Key Vault used by fare-collection systems. What IaC security pattern is that?
• A school district applies landing-zone modules that enable Microsoft Defender plans by default. What Azure IaC practice is that?
• A housing authority drifts from IaC when helpdesk manually opens RDP; automation must catch it. What control focus is that?
• A city enables Microsoft Defender for Cloud recommendations to create work items for the SOC. What automation is that?
• A county auto-triggers investigation packages when Defender for Endpoint flags ransomware behaviors on clerk PCs. What IR link is that?
• A public-health tenant uses Defender alerts to start just-in-time access reviews for admins. What privileged-access response is that?
• A parks department tunes Defender alert suppression for known vulnerability-scanner noise. What operational practice is that?
• A library consortium maps Defender secure score trends to quarterly council security reports. What continuous-improvement use is that?
• A city SOC builds Microsoft Sentinel analytics for impossible travel on Entra IDs used by remote inspectors. What monitoring practice is that?
• A county uses Sentinel automation rules to enrich incidents with the CMDB owner for each VM. What IR enrichment pattern is that?
• A transit fusion center runs Sentinel playbooks that isolate hybrid-joined devices only after dual control. What containment pattern is that?
• An emergency-management agency exports Sentinel incidents to the regional fusion ticket system. What integration is that?
• A court IT team versions Sentinel analytics as code and tests them in a non-prod workspace first. What detection practice is that?
• A city evaluates Azure OpenAI-assisted incident summarization inside Sentinel with private networking. What AI-assisted IR design is that?
• A county wants AI to suggest KQL but requires analyst sign-off before saving analytics. What governance pattern is that?
• A water utility blocks sending OT historian data to Azure AI services used by the IT SOC. What data-boundary practice is that?
• A 311 team uses Copilot-style assist only on already-redacted Sentinel incident narratives. What minimization practice is that?
• A city CISO asks whether AI-driven Azure recommendations replace or only augment Defender secure score work. What positioning is correct?