Automating Workflows GASAE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization uses an on-premises SIEM and a cloud-based SOAR. They want to automate the creation of incidents in the SIEM when the SOAR detects a critical alert. The SIEM API requires OAuth2 authentication. What should the team configure?

   • AA direct database connection from the SOAR to the SIEM to insert incident records.
   • BA connector in the SOAR that uses OAuth2 client credentials to authenticate to the SIEM API and create incidents.
   • CA scheduled task that exports alerts from the SOAR and imports them into the SIEM via CSV.
   • DA shared folder where the SOAR writes incident files and the SIEM picks them up.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is integrating a new threat intelligence platform (TIP) into their existing automated phishing response workflow. The workflow currently uses a different TIP's API to enrich URLs. The team wants to switch to the new TIP without disrupting the existing workflow. What is the best approach?

   • AUse the new TIP's API only for new alerts and keep the old TIP for existing alerts.
   • BRun both TIPs in parallel and use the result from the first TIP that responds.
   • CCreate a new workflow for the new TIP and manually switch between workflows.
   • DReplace the API call in the workflow with the new TIP's API and test the workflow in a staging environment before production.
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   A security team is designing a workflow that enriches alerts with threat intelligence from two vendors. They want the workflow to be maintainable and to handle vendor API changes without rewriting the entire workflow. What design approach should they use?

   • ACreate a separate module for each vendor's API integration, with a common interface for enrichment results.
   • BEmbed the vendor API calls directly in the main workflow logic.
   • CHardcode the vendor API endpoints and authentication tokens in the workflow.
   • DUse a single generic API call that works for both vendors.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team wants to automate the response to a new malware signature: (1) update the firewall rules, (2) notify the SOC, and (3) create a ticket. The firewall update must complete before the SOC notification is sent, but the ticket can be created in parallel. Which orchestration pattern should they use?

   • AA workflow that uses a condition to decide whether to update the firewall or create a ticket.
   • BA parallel workflow: all three actions run simultaneously.
   • CA sequential workflow: update firewall, then notify SOC, then create ticket.
   • DA workflow with a sequential branch for firewall update → SOC notification, and a parallel branch for ticket creation.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of error handling in an automated workflow?

   • ATo automatically fix all errors without human intervention
   • BTo ensure the workflow continues or fails gracefully when an error occurs
   • CTo hide errors from the security team
   • DTo make the workflow run faster by skipping error checks
   Reveal Solution Discussion Select an answer first