You have an Azure subscription that contains an Azure Storage account named storage1. You need to configure a Log Search alert rule that triggers when there are more than 100 failed access attempts within 5 minutes. When the alert triggers, you must meet the following requirements:
1. Automatically disable public network access on storage1 to mitigate the security risk.
2. Send an email notification to the Security Operations team.
Which two actions should you configure in the Azure Monitor Action Group associated with the alert rule? (Select two.)
- An Email/SMS/Push/Voice action configured with the email address of the Security Operations team.Answer
- An Azure Logic App action configured to run a workflow that updates the network rules of storage1.Answer
- CAn Alert Processing Rule configured to disable public network access on storage1 when the alert triggers.
- DA Diagnostic Setting action configured to route logs to an Azure Automation account to disable network access.
Answer
Configure an Email/SMS/Push/Voice action with the email of the Security Operations team, and configure an Azure Logic App action to run a workflow that updates the network rules of storage1.
To satisfy both requirements, you configure the action group with two distinct actions. The email notification is configured using the Email/SMS/Push/Voice action type. The automated security mitigation is achieved using the Azure Logic App action type, which executes a workflow to modify the storage account's network rules.
Step-by-Step Solution
Key Concept
Azure Monitor Action Groups support various action types including notification types (Email/SMS/Push/Voice) and automation/remediation types (Logic Apps, Automation Runbooks, Azure Functions, Webhooks) to respond to alerts.