When designing an automated workflow for security operations, which practice contributes most to maintainability?

Embedding all logic directly into a single, large script

Hardcoding credentials and API endpoints within the workflow

Avoiding comments and documentation to keep the workflow concise

Using modular components with clear, documented inputs and outputs

A security automation workflow uses an API key to authenticate to a ticketing system. The team needs to ensure the key is not exposed in logs or source code. What is the best practice?

Embed the API key directly in the workflow definition for simplicity.

Log the API key in the workflow logs to help with troubleshooting.

Store the API key in a secrets manager and reference it in the workflow, ensuring logs redact the key.

Use a shared service account with a long-lived password instead of an API key.

What is the most common method for integrating a security workflow with an external security tool?

Manually copying data between systems

Using the tool's application programming interface (API)

Sending emails to the tool's support team

Which design principle is most important for ensuring an automated workflow is reliable?

Using a single, complex step to minimize the number of actions

Making the workflow as fast as possible by removing all error checks

Designing the workflow to handle expected failures gracefully

Relying on manual intervention for any unexpected condition

A security automation team is building a workflow that automatically blocks IP addresses on the firewall based on threat intelligence feeds. The compliance team requires that all actions taken by the workflow be attributable to a specific service account and that the workflow's configuration changes be reviewed before deployment. What should the team implement to meet these requirements?

Use the personal credentials of the security analyst who built the workflow.

Grant the workflow's service account full administrator rights to the firewall to ensure it can always block IPs.

Store the workflow definition only in the automation platform's built-in editor without any version history.

Use a dedicated service account with least-privilege permissions for the workflow and store the workflow definition in a version-controlled repository with a peer-review process.

GIAC AI Security Automation Engineer

Domain 1Objective 2

Automating Workflows GASAE Practice Questions (Page 5)

Part of the Security Automation Foundations domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

8concepts

Questions 21–25

21foundation · easy
When designing an automated workflow for security operations, which practice contributes most to maintainability?
Select an answer first
22application · medium
A security automation workflow uses an API key to authenticate to a ticketing system. The team needs to ensure the key is not exposed in logs or source code. What is the best practice?
Select an answer first
23foundation · easy
What is the most common method for integrating a security workflow with an external security tool?
Select an answer first
24foundation · easy
Which design principle is most important for ensuring an automated workflow is reliable?
Select an answer first
25application · medium
A security automation team is building a workflow that automatically blocks IP addresses on the firewall based on threat intelligence feeds. The compliance team requires that all actions taken by the workflow be attributable to a specific service account and that the workflow's configuration changes be reviewed before deployment. What should the team implement to meet these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASAE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASAE” is a trademark of its owner, used for identification only.