Automating Workflows GASAE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How can automated workflows help meet compliance requirements?

   • ABy bypassing security controls to speed up processing
   • BBy allowing unauthenticated access to sensitive data
   • CBy automatically deleting all logs to reduce storage costs
   • DBy ensuring that processes are executed consistently and producing audit logs
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security operations team is designing a workflow that automatically responds to alerts. The workflow must: (1) enrich the alert with threat intelligence, (2) if the enrichment indicates a known malicious indicator, block the indicator on the firewall, and (3) always create a ticket. The team wants to ensure that the workflow is maintainable and that changes to the enrichment logic do not require changes to the blocking or ticketing steps. What is the best design principle to apply?

   • AUse a global variable to store the enrichment result and reference it in all steps.
   • BHardcode the enrichment logic directly into the workflow's conditional branch.
   • CUse a modular design where each step is a separate, reusable function or sub-workflow.
   • DCombine all logic into a single script to reduce complexity.
   Reveal Solution Discussion Select an answer first
4. 13expert · medium

   A security automation team is troubleshooting a workflow that intermittently fails. The logs show that the failure occurs at a specific step, but the error message is not detailed enough. What should the team do to improve troubleshooting?

   • ARemove logging from the failing step to reduce noise.
   • BIncrease the retry count for the failing step to avoid the error.
   • CRun the workflow manually with the same inputs to reproduce the error.
   • DAdd detailed logging at each step, including input/output payloads and error messages, and enable tracing across the workflow.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In an orchestrated security workflow, what is the role of a 'playbook'?

   • AA predefined set of steps and actions to respond to a specific scenario
   • BA document that lists all security tools and their versions
   • CA list of approved software vendors
   • DA log of all past security incidents
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC uses a ticketing system and a threat intelligence platform. They want to automate the creation of a ticket whenever a new indicator of compromise (IOC) is added to the threat intel platform. The workflow must also log the ticket ID for audit purposes. Which integration approach should be used?

   • AManually export the IOC list from the threat intel platform and import it into the ticketing system daily.
   • BHave the ticketing system poll the threat intel platform every minute for new IOCs and create tickets automatically.
   • CConfigure the threat intel platform to send a webhook to the SOAR platform, which then calls the ticketing system's API to create a ticket and logs the response.
   • DUse the SOAR platform to periodically query the threat intel API for new IOCs, create tickets, and store the ticket IDs in a local file.
   Reveal Solution Discussion Select an answer first