Automation CAS-005 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company wants to automate the deployment of a security scanning tool that needs to be run in isolated environments for each project. The tool should be packaged with its dependencies and run consistently across different operating systems. The team wants to use containerization to achieve this. Which approach is most appropriate?

   • ACreate a Docker image that includes the scanning tool and its dependencies, and run it using Docker containers on each project's build server.
   • BUse a Python virtual environment to install the tool and its dependencies.
   • CUse a Bash script that downloads and installs the tool on each server.
   • DUse a virtual machine for each project and install the tool manually.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team wants to automate the onboarding of new employees. The process should create user accounts, assign permissions based on role, and send a welcome email. The team wants to use a workflow automation tool that integrates with their identity management system and email service. Which approach is most appropriate?

   • AUse a PowerShell script that runs on a schedule and checks for new HR tickets.
   • BUse a Bash script that calls the identity management API and email service.
   • CUse a SOAR platform with a playbook that triggers on a new HR ticket and integrates with identity management and email APIs.
   • DUse a Python script that runs continuously and polls for new HR tickets.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security engineer is tasked with automating the quarantine of a user's device when a high-severity alert is triggered. The environment is a Windows Active Directory domain. The engineer wants to use PowerShell and event triggers. However, the engineer is concerned about the script failing if the device is offline. Which approach best addresses this concern?

   • AUse a PowerShell script that runs on a schedule and checks for alerts on each device.
   • BUse a scheduled task on each device that triggers on a specific event and runs a PowerShell script to quarantine the device locally.
   • CUse a SOAR platform that receives alerts from the devices and runs a playbook to quarantine.
   • DUse a central server that polls each device for alerts and runs a PowerShell script remotely.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is a primary security concern when using generative AI models in security automation?

   • AThe model cannot be integrated with other security tools
   • BThe model may produce inaccurate or hallucinated outputs
   • CThe model always requires a GPU to run
   • DThe model is only available on-premises
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst needs to automate the response to a specific event in Windows Event Log (Event ID 4625 - failed logon). The response should immediately block the source IP address using Windows Firewall and log the action to a central file. The analyst wants to use a native Windows mechanism that does not require additional software installation. Which approach should the analyst use?

   • AUse a Python script with the pywin32 library to monitor the event log and execute firewall commands.
   • BCreate a scheduled task that runs a PowerShell script when Event ID 4625 is logged, and the script adds a firewall rule and appends to a log file.
   • CConfigure a Bash script using WSL to watch the event log and invoke netsh commands.
   • DSet up a SOAR platform to ingest the event and run a playbook that blocks the IP.
   Reveal Solution Discussion Select an answer first