Apply Automation and Orchestration ZERO-TRUST-DESIGN Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team is designing an automated playbook for a credential theft incident. The playbook should reset the user's password, revoke active sessions, and notify the user. However, the team is concerned about locking out the user if the alert is a false positive. What is the best way to design this playbook?

   • AAutomate the notification to the user, but require human approval for password reset and session revocation.
   • BAutomate all three actions without human approval to respond quickly.
   • CAutomate the session revocation and password reset, but require human approval before notifying the user.
   • DRequire human approval for all three actions to avoid any risk.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following security monitoring tasks is most suitable for automation?

   • ADeciding whether to terminate an employee for a policy violation.
   • BInterviewing employees about their security awareness.
   • CCollecting and aggregating logs from multiple sources into a central repository.
   • DConducting a subjective review of a new security policy's wording.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is evaluating whether to automate a complex incident response playbook that involves multiple tools and decision points. They are concerned about the maintainability and the risk of errors in the automation logic. What is the best way to mitigate these concerns?

   • AAvoid automation entirely and rely on manual response to prevent errors.
   • BAutomate only the alert triage and leave all response actions manual.
   • CAutomate the entire playbook at once to achieve immediate benefits.
   • DStart with a small, well-defined playbook, test it thoroughly in a sandbox, and gradually expand its scope.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In policy-driven automation, what is the primary source that determines whether an access request is automatically approved or denied?

   • AThe security analyst's intuition.
   • BThe time of day the request is made.
   • CThe user's role in the organization.
   • DThe Zero Trust policy engine's rules and context.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A compliance team must regularly verify that all servers have the latest security patches. Currently, they manually check each server and document the results. They want to automate this compliance check and integrate it with their monitoring system. What should they do?

   • ACreate a monthly report by manually collecting patch data from each server.
   • BDisable patch management and rely on the vendor's default settings.
   • CUse a configuration management tool to continuously assess patch compliance and feed the results into the SIEM for alerting on non-compliant servers.
   • DSet up a scheduled task that emails a list of all servers to the compliance team for manual review.
   Reveal Solution Discussion Select an answer first