4.3 Modify a Provided Script to Automate a Security Operations Task 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A script that processes security alerts sometimes encounters malformed JSON in the input file, causing the script to crash. The analyst needs to ensure the script skips malformed lines and continues. What should be added?

   • AA check to ensure the file is not empty before processing.
   • BA modification to the JSON parser to automatically fix malformed lines.
   • CA try-except block around the JSON parsing that logs the error and continues.
   • DA loop that retries parsing the same line multiple times.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A script processes security events and currently includes all events. The analyst needs to modify the script to include only events with severity level 'high'. Which logic change is appropriate?

   • ASort the events by severity before processing
   • BAdd a condition: if event['severity'] == 'high': process(event)
   • CChange the event processing function to accept a severity parameter
   • DUse a loop that processes every event twice
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A script processes log entries and expects each entry to have a 'timestamp' field. Some entries may be missing this field, causing a KeyError. The analyst needs to modify the script to handle this robustly. Which change is best?

   • AAdd a print statement before accessing the field
   • BChange the field name to 'time'
   • CRemove the timestamp field from all entries
   • DUse entry.get('timestamp', 'unknown') to provide a default value
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   After modifying a security operations script, the analyst wants to verify it works correctly. Which approach is most appropriate for testing?

   • ARun the script with a small sample of known data and compare the output to expected results
   • BAsk a colleague to run the script on their machine
   • CReview the code visually and assume it is correct
   • DRun the script on the production data without checking the output
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A provided Python script currently extracts IP addresses from a text file using a regex pattern. The analyst needs to modify the script to also extract port numbers that appear after the IP addresses in the format 'IP:port'. Which modification is most appropriate?

   • AReplace the regex with a simple string find for ':'
   • BChange the regex pattern to capture both IP and port, e.g., r'(\d+\.\d+\.\d+\.\d+):(\d+)'
   • CAdd a second loop that reads the file again and prints every number found
   • DUse the split method on each line and take the last element
   Reveal Solution Discussion Select an answer first