Automation and Orchestration SY0-701 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst must parse a large number of security logs from different sources and extract IP addresses that appear more than 100 times in a day. The analyst wants to automate this task to run daily. Which scripting approach is most appropriate?

   • AUse a batch script that copies all log files to a single directory and renames them with the current date.
   • BWrite a Python script that reads each log file, uses regular expressions to extract IP addresses, counts occurrences, and outputs the results to a report.
   • CManually open each log file in a text editor and use the find feature to count IP addresses.
   • DCreate a PowerShell script that only sorts the log files by size.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company plans to automate the response to phishing emails reported by employees. The automation will quarantine the email and block the sender. Which factor is most important to consider before implementing this automation?

   • AThe cost of the email security software license.
   • BThe color scheme of the phishing alert notification.
   • CThe potential for false positives that quarantine legitimate emails and disrupt business communications.
   • DThe number of employees who have reported phishing emails in the past month.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An organization uses an on-premises SIEM and a cloud-based email security service. The security team wants to automate the creation of incidents in the SIEM when the email service detects a malicious attachment. Which integration approach is most appropriate?

   • AReplace the on-premises SIEM with the email service's built-in reporting.
   • BUse the email service's API to send alerts to the SIEM via a webhook.
   • CDisable the email service's detection features to reduce false positives.
   • DManually copy alerts from the email service console to the SIEM.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A security manager is planning to automate a critical security process. What should be done before deploying the automation?

   • ADisable all logging to reduce noise
   • BAssign the automation to run without any oversight
   • CThoroughly test the automation in a controlled environment
   • DImmediately replace the manual process to avoid delays
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security operations team manually reviews thousands of firewall logs each day to identify failed login attempts. The team wants to reduce the time spent on this repetitive task and ensure consistent response. Which action best addresses the need?

   • AImplement a SOAR platform that ingests firewall logs, correlates failed login events, and automatically opens a ticket for each event.
   • BCreate a script that archives firewall logs to a central storage repository for later analysis.
   • CIncrease the number of analysts assigned to log review during peak hours.
   • DConfigure the firewall to block all failed login attempts automatically.
   Reveal Solution Discussion Select an answer first