Apply Automation and Orchestration ZERO-TRUST-DESIGN Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company uses a SIEM to collect logs from various sources. They want to automate the correlation of logs to detect a multi-step attack pattern. What is the most effective way to achieve this?

   • AConfigure the SIEM with correlation rules that trigger alerts when the sequence of events matches the attack pattern.
   • BManually review all logs each day to identify the attack pattern.
   • CUse a firewall to block traffic that matches the attack pattern.
   • DSet up a script that periodically searches for individual events in the logs.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A Zero Trust environment relies on continuous monitoring of user behavior and device posture. The security team wants to ensure that any deviation from baseline is detected and addressed promptly. Which automation approach best supports this requirement?

   • ADeploy automated user and entity behavior analytics (UEBA) that trigger alerts and automated responses when anomalies are detected.
   • BSchedule a nightly batch job that reviews all user activity logs from the previous day.
   • CSet up a dashboard that displays all user activity for manual review by analysts.
   • DImplement a policy that requires users to re-authenticate every hour regardless of behavior.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How can automation support continuous monitoring in a Zero Trust environment?

   • ABy requiring analysts to manually check dashboards every hour.
   • BBy continuously collecting and analyzing security telemetry without human intervention.
   • CBy scheduling weekly vulnerability scans.
   • DBy periodically sending reports to management for manual review.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team wants to automate the initial response to a suspected data exfiltration. The playbook should disable the user's account, block the destination IP, and create a ticket for investigation. However, the team is concerned about false positives. What is the best way to design this playbook?

   • AAutomate the account disable and IP block, but require human approval before creating the investigation ticket.
   • BAutomate all three actions without any human approval to respond quickly.
   • CRequire human approval for all three actions to avoid any risk.
   • DAutomate the ticket creation, but require human approval for the account disable and IP block.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A large enterprise is implementing SOAR to automate incident response. The security team is concerned that automated playbooks might inadvertently disrupt business operations if they act on false positives. They want to balance automation speed with safety. Which approach best addresses this concern?

   • ADisable automation entirely and rely on manual response to avoid any risk of disruption.
   • BAutomate all response actions without human intervention to achieve maximum speed.
   • CDesign playbooks with conditional steps that require human approval for high-impact actions, while automating low-risk containment actions.
   • DUse automation only for alert triage and never for response actions.
   Reveal Solution Discussion Select an answer first