A security team has developed a SOAR playbook that automatically disables a user account after three failed login attempts. During testing, the team finds that a legitimate user is locked out because they mistyped their password. The team wants to reduce false lockouts without significantly increasing the risk of brute-force attacks. What is the best modification?

Increase the threshold to 10 failed attempts before disabling the account.

Send an alert to the security team but do not disable the account.

Add a temporary lockout for 15 minutes instead of disabling the account permanently.

Disable the account only if the failed attempts come from different IP addresses.

Why is it important to integrate defensive automation with existing security tools?

To eliminate the need for security analysts

To reduce the need for security monitoring

To replace all existing security tools with a single automated solution

To enhance the overall security posture by leveraging existing investments and data

What is the purpose of continuous monitoring and alerting in defensive automation?

To generate periodic compliance reports

To provide real-time visibility into security events and notify relevant parties

To automatically patch vulnerabilities without human intervention

To replace the need for security incident response teams

A company uses a ticketing system for incident management and a SOAR platform for automation. The security team wants to automatically create a ticket when a high-severity alert is confirmed. What is the best way to integrate the SOAR platform with the ticketing system?

Manually copy alert details into the ticketing system.

Use the SOAR platform's built-in integration to create a ticket via the ticketing system's API.

Have the SOAR platform send an email to the ticketing system's email-to-ticket feature.

Use a shared spreadsheet to track incidents.

What is the goal of automated remediation?

To detect potential threats and alert security teams

To document security incidents for compliance purposes

To simulate attacks to test security controls

To automatically fix vulnerabilities and restore systems to a secure state

GIAC AI Security Automation Engineer

Domain 4Objective 2

Defensive Security Automation GASAE Practice Questions (Page 10)

Part of the Offensive and Defensive Automation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

9concepts

Questions 46–50

46expert · hard
A security team has developed a SOAR playbook that automatically disables a user account after three failed login attempts. During testing, the team finds that a legitimate user is locked out because they mistyped their password. The team wants to reduce false lockouts without significantly increasing the risk of brute-force attacks. What is the best modification?
Select an answer first
47foundation · easy
Why is it important to integrate defensive automation with existing security tools?
Select an answer first
48foundation · easy
What is the purpose of continuous monitoring and alerting in defensive automation?
Select an answer first
49application · medium
A company uses a ticketing system for incident management and a SOAR platform for automation. The security team wants to automatically create a ticket when a high-severity alert is confirmed. What is the best way to integrate the SOAR platform with the ticketing system?
Select an answer first
50foundation · easy
What is the goal of automated remediation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASAE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASAE” is a trademark of its owner, used for identification only.