Automating Workflows GASAE Practice Questions (Page 2)

Questions 6–10

1. 6expert · medium

   A security operations team is automating a multi-step incident response process that involves: (1) enriching the alert with threat intel, (2) blocking the malicious IP on the firewall, and (3) notifying the incident commander. The enrichment step is slow and sometimes times out. The team wants to ensure that the blocking and notification steps still execute even if enrichment fails. What orchestration pattern should they use?

   • ARun enrichment first, and if it fails, abort the entire workflow.
   • BRun enrichment and blocking sequentially, and only notify if both succeed.
   • CRun enrichment in a separate branch that can fail independently, while the blocking and notification steps run in a parallel branch that does not depend on enrichment.
   • DRun all steps in parallel, but if enrichment fails, retry it indefinitely until it succeeds.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the function of 'conditional logic' in an automated workflow?

   • ATo log all workflow activities for auditing
   • BTo schedule the workflow to run at specific times
   • CTo determine which path the workflow should take based on data or context
   • DTo encrypt the data flowing through the workflow
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team uses a SOAR platform to automate phishing response. They need the workflow to: (1) automatically quarantine a message if the user clicked the link, (2) only escalate to the incident response team if the message was sent from an external domain, and (3) retry the quarantine action up to two times if the API call fails. Which configuration should the team implement?

   • AA single workflow with a conditional branch on click status, a conditional branch on sender domain, and a retry loop around the quarantine action.
   • BTwo separate workflows: one for click status and one for sender domain, each with its own retry logic for the quarantine action.
   • CA single workflow that always quarantines the message and then escalates if the sender domain is external, with no retry logic.
   • DA single workflow that uses a parallel branch to check click status and sender domain, then quarantines only if both are true, with a fixed delay instead of retry.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security automation team has a workflow that automatically blocks malicious IPs on the firewall. The workflow calls the firewall API, which occasionally returns a '500 Internal Server Error' that persists for a few minutes. The team wants the workflow to be resilient without delaying the blocking action for too long. They also need to know if the block ultimately failed. What is the best approach?

   • AConfigure a retry policy with exponential backoff, a maximum of 5 attempts, and if all retries fail, send an alert and log the failure.
   • BRetry the API call indefinitely until it succeeds.
   • CSkip the firewall block and continue with the next step in the workflow.
   • DFail the workflow immediately on the first 500 error and create a high-priority ticket.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the role of a 'connector' in workflow integration?

   • AIt is a database that stores all workflow logs
   • BIt is a type of firewall rule that allows traffic between systems
   • CIt is a physical cable that connects servers in a data center
   • DIt provides a pre-built interface between the workflow engine and a specific tool or service
   Reveal Solution Discussion Select an answer first