A security team wants to detect and respond to port scanning activity against their EC2 instances. They have enabled VPC Flow Logs and want to use EventBridge to trigger a Lambda function when suspicious traffic is detected. What is the most effective way to achieve this?

Use AWS Security Hub to analyze VPC Flow Logs and automatically isolate instances that are being port scanned.

Create an EventBridge rule that directly matches VPC Flow Log entries with a high number of rejected connections.

Use Amazon GuardDuty to analyze VPC Flow Logs for port scanning patterns and trigger an EventBridge rule when a finding is generated.

Use AWS Config to evaluate VPC Flow Logs and trigger a Lambda function when the flow log records show repeated connection attempts.

What is the primary benefit of using AWS Step Functions for incident response?

It allows you to define a visual workflow with retries and error handling

It provides a real-time dashboard for security findings

It automatically blocks all malicious traffic

It replaces the need for Lambda functions

What is the primary purpose of an AWS Config rule?

To block all network traffic to a resource

To monitor API calls for unauthorized actions

To define the desired configuration state of a resource and evaluate compliance

To encrypt all data at rest in S3

GIAC AI Security Automation Engineer

Domain 2Objective 1

AWS Cloud Security and Incident Response Automation GASAE Practice Questions (Page 5)

Part of the Cloud Security Automation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 8–13 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

15concepts

Questions 21–25

21foundation · easy
Which AWS IAM entity is best suited for granting temporary permissions to an application running on an EC2 instance?
Select an answer first
22application · medium
A security team wants to detect and respond to port scanning activity against their EC2 instances. They have enabled VPC Flow Logs and want to use EventBridge to trigger a Lambda function when suspicious traffic is detected. What is the most effective way to achieve this?
Select an answer first
23foundation · easy
What is the primary benefit of using AWS Step Functions for incident response?
Select an answer first
24foundation · easy
What is the primary purpose of an AWS Config rule?
Select an answer first
25foundation · easy
Which AWS service is designed to orchestrate multi-step workflows, such as incident response runbooks?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASAE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASAE” is a trademark of its owner, used for identification only.

AWS Cloud Security and Incident Response Automation GASAE Practice Questions (Page 5)

Questions 21–25

Which AWS IAM entity is best suited for granting temporary permissions to an application running on an EC2 instance?

A security team wants to detect and respond to port scanning activity against their EC2 instances. They have enabled VPC Flow Logs and want to use EventBridge to trigger a Lambda function when suspicious traffic is detected. What is the most effective way to achieve this?

What is the primary benefit of using AWS Step Functions for incident response?

What is the primary purpose of an AWS Config rule?

Which AWS service is designed to orchestrate multi-step workflows, such as incident response runbooks?

Keep studying — Cloud Security Automation