Automate Security Workflows CY0-001 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · medium

   Which action is an example of AI automating an incident response step?

   • AAutomatically isolating an infected endpoint from the network.
   • BManually writing a post-incident report.
   • CHolding a meeting to discuss the incident.
   • DWaiting for a user to report a problem.
   Reveal Solution Discussion Select an answer first
2. 22foundation · medium

   What is a primary benefit of automating security workflows with AI?

   • AIt guarantees that no security incidents will ever occur.
   • BIt reduces the time required to perform routine security tasks consistently.
   • CIt automatically patches all software vulnerabilities without any configuration.
   • DIt eliminates the need for human oversight in all security operations.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security operations center (SOC) receives hundreds of alerts daily, many of which are false positives. The team wants to automate the initial response to low-confidence alerts by enriching them with threat intelligence and automatically quarantining affected endpoints if the enrichment confirms malicious activity. They also want to escalate to a human analyst only when the AI is uncertain. Which approach best achieves this?

   • AImplement a SOAR playbook that enriches alerts with threat intel, uses a machine learning model to score confidence, and triggers automated quarantine for high-confidence positives while escalating uncertain cases.
   • BIncrease the SIEM alert threshold to only generate alerts for critical severity events, reducing the volume of alerts.
   • CDeploy an endpoint detection and response (EDR) tool and configure it to automatically block all processes that are not on an allowlist.
   • DHire additional SOC analysts to manually review every alert and perform enrichment.
   Reveal Solution Discussion Select an answer first
5. 24foundation · medium

   How can AI optimize a security workflow for efficiency?

   • ABy increasing the number of false positives.
   • BBy prioritizing alerts based on risk scores.
   • CBy requiring more manual steps in the workflow.
   • DBy ignoring low-risk alerts entirely.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An organization uses a legacy SIEM that does not have built-in AI capabilities. They want to add AI-driven anomaly detection to their security monitoring without replacing the SIEM. They have a data lake where all logs are stored. What is the best way to integrate AI into their existing security system?

   • AManually export logs from the SIEM to a spreadsheet and use Excel to look for anomalies.
   • BInstall an AI plugin directly into the SIEM's database to analyze logs in place.
   • CUse a separate AI/ML analytics platform that reads data from the data lake, generates anomaly scores, and sends alerts back to the SIEM via API.
   • DReplace the SIEM with a new AI-native SIEM that includes built-in anomaly detection.
   Reveal Solution Discussion Select an answer first