Defensive Security Automation GASAE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A vulnerability scanner identifies a critical remote code execution vulnerability on a set of internet-facing web servers. The security team has an automated remediation workflow that patches servers by applying the vendor's update. However, the workflow currently patches all servers simultaneously, and the team is concerned about service availability. Which modification to the workflow would best balance the need for rapid remediation with the risk of service disruption?

   • APatch all servers at once to minimize the time the vulnerability is exposed.
   • BPatch only one server and then wait for a week to observe for issues before patching the rest.
   • CDisable the automated workflow and have the team manually patch servers during the next maintenance window.
   • DImplement a rolling deployment that patches servers in batches, with health checks after each batch, and automatically rolls back if a health check fails.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a key consideration when designing an automation workflow for defensive security?

   • AEnsuring the workflow runs only during business hours
   • BMaking the workflow as complex as possible to cover all scenarios
   • CAvoiding any human involvement in the workflow
   • DEnsuring the workflow is reliable and can handle errors gracefully
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security engineer is designing an automated workflow that handles data exfiltration incidents. The workflow must: (1) identify the affected endpoint, (2) block the endpoint's network access, (3) notify the incident response team, and (4) create a forensic snapshot of the endpoint. The team has a requirement that the forensic snapshot must be taken before the endpoint is powered off, but the endpoint may be powered off by the user at any time. The engineer wants to ensure the snapshot is taken as soon as possible. Which workflow design is most appropriate?

   • ARun the forensic snapshot step in parallel with the network blocking step, and before the notification step.
   • BRun the notification step first, then the snapshot, then network blocking.
   • CRun the network blocking step first, then the snapshot, then notification.
   • DRun the snapshot step only after the user confirms the endpoint is still on.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team wants to implement continuous monitoring for insider threats. They have access to employee authentication logs, file access logs, and email metadata. The team wants to detect when an employee accesses sensitive files outside of their normal working hours and then sends an email with an attachment. The team is concerned about privacy regulations. What is the best approach?

   • ACreate a SIEM correlation rule that alerts when an employee accesses sensitive files outside normal hours and then sends an email with an attachment within a short time window.
   • BAlert on any after-hours file access.
   • CMonitor the content of all emails to detect sensitive data exfiltration.
   • DDisable monitoring for employees who have been with the company for more than 5 years.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst wants to automate the detection of data exfiltration from their cloud storage. They have access to cloud audit logs and a SIEM. The detection should trigger when a user downloads a large volume of data from a sensitive bucket outside business hours. What is the most effective automated detection mechanism?

   • AA rule that alerts on any download from a sensitive bucket.
   • BA scheduled job that runs daily and reviews all download logs.
   • CA SIEM correlation rule that monitors audit logs for download events from sensitive buckets, aggregates by user, and alerts when the total volume exceeds a threshold during off-hours.
   • DA machine learning model that detects anomalies in user behavior, trained on historical data.
   Reveal Solution Discussion Select an answer first