Automating Workflows GASAE Practice Questions (Page 8)

Questions 36–40

1. 36expert · medium

   A large enterprise is automating incident response across multiple tools: ticketing, firewall, and EDR. The workflow must: (1) create a ticket, (2) block the compromised host on the firewall, and (3) isolate the host in the EDR. The team wants to minimize the time to containment while ensuring that if the firewall block fails, the EDR isolation still occurs. What orchestration pattern should they use?

   • ARun all three actions in parallel, and if any action fails, retry it independently.
   • BRun the ticket creation first, then the firewall block, then the EDR isolation sequentially.
   • CRun the firewall block and EDR isolation in parallel, but only after the ticket is created.
   • DRun the firewall block first, and only if it succeeds, run the EDR isolation and ticket creation in parallel.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A team is designing a workflow that enriches alerts with threat intelligence. They want the workflow to be maintainable and avoid unnecessary API calls. Which design principle should they apply?

   • AAlways enrich every alert with all available sources to ensure completeness.
   • BUse a hardcoded list of enrichment sources that never changes.
   • CUse a single large workflow that handles all alert types and enrichment sources.
   • DBreak the workflow into modular steps, each with a clear purpose, and add conditions to skip enrichment if the alert already has sufficient data.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Why is logging important in automated security workflows?

   • ATo provide an audit trail for troubleshooting and compliance
   • BTo increase the speed of the workflow
   • CTo automatically resolve security incidents
   • DTo replace the need for human monitoring
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security operations team automates phishing alert triage. The workflow enriches the sender domain with a reputation service, checks the email body for known indicators, and then assigns a severity. The team wants to ensure that if the enrichment service is temporarily unavailable, the workflow does not fail immediately but instead retries the API call a few times with a short delay. Which configuration best meets this requirement?

   • AAdd a conditional branch that skips enrichment when the API returns an error.
   • BConfigure a retry policy on the enrichment step with exponential backoff and a maximum of three attempts.
   • CUse a webhook trigger that re-invokes the workflow whenever the enrichment API becomes available again.
   • DSet the workflow to run enrichment in parallel with the body check to reduce overall runtime.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the purpose of a 'retry' mechanism in a workflow?

   • ATo attempt a failed step again, often after a delay
   • BTo send an email to the administrator
   • CTo permanently stop the workflow after the first failure
   • DTo log the error and continue to the next step
   Reveal Solution Discussion Select an answer first