Automate Security Workflows CY0-001 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team wants to automate the initial triage of phishing emails reported by employees. They need a tool that can extract indicators from emails, query threat intelligence feeds, and open a ticket in their ITSM system if the email is suspicious. The team has limited coding experience and prefers a low-code solution. Which approach best meets these requirements?

   • AWrite a custom Python script that uses an email API, a threat intel API, and the ITSM API.
   • BDeploy an open-source intrusion detection system and configure it to send alerts to the ITSM system.
   • CUse a SOAR platform with pre-built connectors for email parsing, threat intel lookup, and ITSM integration.
   • DConfigure the email gateway to automatically quarantine all emails with links and attachments.
   Reveal Solution Discussion Select an answer first
2. 2foundation · medium

   Which scenario best illustrates the principle of security workflow automation?

   • AAn analyst manually reviews each alert and decides whether to escalate it.
   • BA security team holds a weekly meeting to discuss recent incidents.
   • CA firewall is configured once and then left unchanged.
   • DA script automatically enriches incoming alerts with threat intelligence and assigns risk scores.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team is spending too much time manually correlating alerts from multiple sources. They want to use AI to automatically group related alerts into incidents and prioritize them based on potential impact. They also need to ensure that the AI model is periodically retrained with new data to maintain accuracy. Which combination of actions best addresses both needs?

   • APurchase a threat intelligence feed and manually apply indicators to alerts.
   • BUse a SIEM to create manual correlation rules and rely on analysts to prioritize incidents.
   • CDeploy a SOAR platform that only automates response actions, leaving correlation to analysts.
   • DImplement an AI-based alert correlation engine that clusters alerts into incidents and assigns a risk score, and schedule regular model retraining with fresh data.
   Reveal Solution Discussion Select an answer first
5. 4foundation · medium

   What is a key component of an AI-based automated threat detection system?

   • AA static list of known IP addresses to block.
   • BA manual process for reviewing logs every week.
   • CA firewall rule that blocks all incoming traffic.
   • DA model trained on historical security data to recognize anomalies.
   Reveal Solution Discussion Select an answer first
6. 5foundation · medium

   What is a primary advantage of using AI to automate incident response?

   • AIt guarantees that incidents never recur.
   • BIt reduces the time to contain a security incident.
   • CIt removes all human involvement from incident response.
   • DIt eliminates the need for incident response plans.
   Reveal Solution Discussion Select an answer first