Defensive Security Automation GASAE Practice Questions (Page 11)

Questions 51–52

1. 51expert · hard

   A company has an automated incident response playbook that, upon detection of a ransomware indicator, performs three actions: (1) isolates the affected host via the firewall, (2) disables the user account in Active Directory, and (3) initiates a backup restoration. The playbook is triggered by a SIEM alert. During a real incident, the SIEM alert fired, but the host isolation step failed because the firewall API was temporarily unavailable. The playbook continued to the next steps, disabling the account and starting a backup restoration. The backup restoration was later found to be unnecessary and caused service disruption. The team wants to modify the playbook to prevent this outcome. Which change is most appropriate?

   • ARemove the backup restoration step from the playbook entirely.
   • BAdd a conditional check after each step that stops the playbook if a critical step fails, and require manual approval before non-critical steps.
   • CRun all steps in parallel so that the failure of one step does not affect the others.
   • DChange the order of steps so that backup restoration runs before host isolation.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A company has an automated incident response playbook that, upon detection of a phishing email, automatically deletes the email from all user mailboxes and blocks the sender. The playbook is triggered by user reports. Recently, a user reported a legitimate email as phishing, and the playbook deleted the email and blocked the sender, causing disruption. The team wants to prevent this from happening. Which change is most appropriate?

   • AAdd a verification step that checks the email against known phishing indicators before taking action, and if the check is inconclusive, route it to a human analyst.
   • BRemove the automatic deletion step and only block the sender.
   • CRequire two user reports before the playbook takes action.
   • DDisable the playbook and handle all phishing reports manually.
   Reveal Solution Discussion Select an answer first