Automating Workflows GASAE Practice Questions (Page 6)

Questions 26–30

1. 26expert · medium

   A security team is integrating a SOAR platform with a legacy ticketing system that only supports basic authentication over HTTP. The team wants to automate ticket creation but is concerned about security. What is the best approach?

   • AUse a shared service account with a hardcoded password in the workflow.
   • BDisable authentication on the legacy system to simplify integration.
   • CSend the basic authentication credentials over HTTP directly from the SOAR platform.
   • DUse a gateway or reverse proxy that terminates TLS and forwards to the legacy system, and store credentials in a secrets manager.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A compliance team requires that all automated workflow executions be logged with the user who triggered them, the time, and the outcome. What should the team configure in the workflow platform?

   • AEnable audit logging that captures the trigger user, timestamp, and final status for every execution.
   • BDisable logging for workflows that handle sensitive data.
   • CLog only the workflow name and execution ID.
   • DStore logs in a local file on the workflow server without any retention policy.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following best describes the role of workflow automation in a security operations center (SOC)?

   • AIt replaces the need for security information and event management (SIEM) systems
   • BIt automatically patches all vulnerabilities without human intervention
   • CIt provides a mechanism to execute predefined, repeatable processes consistently and efficiently
   • DIt stores all security logs for compliance purposes
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In a security workflow, what is the purpose of a 'trigger'?

   • ATo authenticate the workflow with external systems
   • BTo store the results of the workflow for later analysis
   • CTo initiate the workflow based on a specific event or condition
   • DTo define the actions to be taken when a condition is met
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A workflow is designed to block an IP address on the firewall if the threat intelligence score is above 80. The team wants to avoid blocking internal IPs. What should they add to the workflow?

   • AA logging step that records the IP address.
   • BA parallel branch that also notifies the SOC.
   • CA retry mechanism for the firewall API call.
   • DA condition that checks if the IP is in the internal range before blocking.
   Reveal Solution Discussion Select an answer first