A small SOC receives hundreds of low-severity alerts daily. They want to reduce analyst fatigue by automating the initial triage: if an alert matches a known false-positive pattern, close it automatically; otherwise, escalate to an analyst. What is the primary benefit of this workflow?

It increases the speed of alert generation.

It reduces the number of alerts analysts must manually review, allowing them to focus on higher-priority issues.

It eliminates the need for human analysts entirely.

It guarantees that no false positives will ever reach an analyst.

A security workflow calls an external API that occasionally returns a 503 (service unavailable) error. The team wants the workflow to retry the call, but only up to three times, with a delay between attempts. What is the best way to implement this?

Ignore the error and continue the workflow without the API data.

Use a loop that retries up to three times with a fixed delay of 30 seconds between attempts.

Use a single retry after 60 seconds, then fail the workflow.

Immediately fail the workflow and alert the administrator.

A security operations center (SOC) wants to automate the containment of compromised endpoints. The workflow must: (1) isolate the endpoint using the EDR tool, (2) block the attacker's IP on the firewall, and (3) create a ticket in the ticketing system. The team wants to ensure that if the firewall blocking fails, the ticket is still created but marked with a 'partial containment' status. What is the best way to design this workflow?

Create the ticket before attempting isolation and firewall blocking.

Run steps sequentially and stop the workflow if any step fails.

Make firewall blocking the last step so that ticket creation always happens first.

Use parallel branches for isolation and firewall blocking, then a join that always proceeds to ticket creation with the status based on the success of the previous steps.

Which practice is essential for securing automated workflows?

Storing credentials in plain text within the workflow code

Sharing credentials among all team members for easy access

Disabling authentication for workflow APIs to simplify integration

Using a secure secret management solution to store credentials and API keys

What is the primary purpose of monitoring workflow execution?

To detect failures, bottlenecks, and anomalies in real time

To ensure the workflow never fails

To automatically modify the workflow code

To replace the need for logging

GIAC AI Security Automation Engineer

Domain 1Objective 2

Automating Workflows GASAE Practice Questions (Page 7)

Part of the Security Automation Foundations domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

8concepts

Questions 31–35

31application · medium
A small SOC receives hundreds of low-severity alerts daily. They want to reduce analyst fatigue by automating the initial triage: if an alert matches a known false-positive pattern, close it automatically; otherwise, escalate to an analyst. What is the primary benefit of this workflow?
Select an answer first
32application · medium
A security workflow calls an external API that occasionally returns a 503 (service unavailable) error. The team wants the workflow to retry the call, but only up to three times, with a delay between attempts. What is the best way to implement this?
Select an answer first
33application · medium
A security operations center (SOC) wants to automate the containment of compromised endpoints. The workflow must: (1) isolate the endpoint using the EDR tool, (2) block the attacker's IP on the firewall, and (3) create a ticket in the ticketing system. The team wants to ensure that if the firewall blocking fails, the ticket is still created but marked with a 'partial containment' status. What is the best way to design this workflow?
Select an answer first
34foundation · easy
Which practice is essential for securing automated workflows?
Select an answer first
35foundation · easy
What is the primary purpose of monitoring workflow execution?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASAE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASAE” is a trademark of its owner, used for identification only.