Defensive Security Automation GASAE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an example of an automated alerting mechanism?

   • AManually reviewing system logs at the end of the day
   • BConducting a quarterly security audit
   • CSending an email to the security team when a failed login threshold is exceeded
   • DUpdating firewall rules based on new threat intelligence
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security engineer is designing an automated workflow that responds to phishing emails reported by users. The workflow must extract the malicious URL, block it on the proxy, and notify the user. The engineer wants to ensure that the workflow is reliable and does not fail if one step encounters an error. Which design principle should be applied?

   • ARun all steps in parallel to reduce the overall execution time.
   • BAdd error handling and retries for each step, and log failures for manual review.
   • CSkip the notification step if the URL blocking fails to save time.
   • DUse a single monolithic script that performs all actions sequentially without error handling.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security operations center (SOC) uses a SIEM platform that receives alerts from multiple sources. The team wants to integrate an automated response tool that can query the SIEM for alerts, enrich them with threat intelligence, and trigger a containment action in the firewall. The integration must use the SIEM's official API and must not require custom scripting for each alert source. Which approach should the team take?

   • AUse the SIEM's built-in API connector in the automation tool to pull alerts, enrich them, and invoke firewall actions through a standardized playbook.
   • BWrite a custom script that parses the SIEM's database directly and sends commands to the firewall via SSH.
   • CHave the automation tool periodically export alerts from the SIEM to a CSV file and then process the file to trigger firewall changes.
   • DConfigure the firewall to send all its logs to the SIEM and rely on the SIEM's alerting to trigger firewall actions automatically.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an example of an automated remediation action?

   • AGenerating an alert when a vulnerability is detected
   • BAutomatically applying a security patch to a vulnerable application
   • CReviewing security logs for suspicious activity
   • DConducting a vulnerability scan of the network
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's vulnerability scanner identifies a critical vulnerability on a fleet of Linux servers. The security team wants to automate remediation. The servers are managed by a configuration management tool, and the security team has a change-management policy that requires all production changes to be approved by the change advisory board (CAB). What is the best approach?

   • AManually patch a few servers and then use the configuration management tool to replicate the change to the rest.
   • BUse the vulnerability scanner's built-in auto-remediation feature without involving the configuration management tool.
   • CAutomatically apply the patch to all servers as soon as the scanner reports the vulnerability.
   • DCreate a configuration management playbook that patches servers, but require CAB approval before the playbook runs in production.
   Reveal Solution Discussion Select an answer first