Automating Workflows GASAE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of workflow orchestration in security automation?

   • ATo generate reports for management review
   • BTo store and index security logs for later analysis
   • CTo replace individual security tools with a single unified platform
   • DTo coordinate multiple automated tasks and tools into a cohesive, end-to-end process
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security automation team is deploying a workflow that processes sensitive user data. Compliance requires that every execution be auditable, including who triggered it, what data was accessed, and the final outcome. What should the team implement?

   • AEnable detailed logging for each workflow step, including input/output payloads, and store logs in a tamper-evident location.
   • BDisable logging for steps that handle sensitive data to reduce exposure.
   • CStore logs in the same database as the workflow's operational data for easy access.
   • DLog only the start and end times of the workflow, without capturing intermediate data.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security automation team is building a workflow that automatically removes malware from endpoints using an EDR tool. The compliance team requires that the workflow use a service account with the minimum permissions necessary and that all actions be logged for audit. What should the team implement?

   • ADisable logging to reduce performance overhead.
   • BUse the global admin account for the EDR tool to ensure the workflow always succeeds.
   • CUse a shared analyst account and rely on the EDR tool's native logs.
   • DCreate a dedicated service account with only the EDR permissions needed to remove malware, and enable detailed logging on the workflow.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In security operations, what is the primary purpose of workflow automation?

   • ATo replace human analysts with fully autonomous decision-making
   • BTo ensure all security alerts are automatically resolved without human review
   • CTo eliminate the need for security monitoring and incident response
   • DTo standardize and accelerate repetitive security tasks while reducing manual effort
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An automated malware-analysis workflow runs a sandbox and then posts results to a SIEM. The sandbox occasionally times out, and the SIEM API sometimes returns a 429 (rate limit) error. The team wants the workflow to be resilient without overloading the SIEM. What should they configure?

   • ASkip the SIEM call if it fails and continue the workflow, logging the error.
   • BA single retry for the SIEM call and a long timeout for the sandbox, with no fallback.
   • CA fixed retry of 5 times for both the sandbox and SIEM calls, with no timeout handling.
   • DA retry with exponential backoff for the SIEM API call, and a timeout with a fallback action for the sandbox step.
   Reveal Solution Discussion Select an answer first