Defensive Security Automation GASAE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an example of maintaining defensive automation?

   • AUpdating the list of indicators of compromise used by the detection scripts
   • BIncreasing the frequency of manual security reviews
   • CDisabling automation during non-business hours
   • DDeleting logs to free up storage space
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team has an automated alerting system that uses a list of known-bad domains. The team notices that the list is outdated and the system is missing new malicious domains. What is the best way to maintain the automation?

   • AManually update the domain list once a month.
   • BReplace the domain list with a machine learning model.
   • CIncrease the frequency of alerts to catch more domains.
   • DSubscribe to a commercial threat intelligence feed and automatically update the domain list.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company wants to implement continuous monitoring of its cloud infrastructure for misconfigurations. The security team has a policy that any critical misconfiguration must be alerted within 5 minutes of detection. They are evaluating two tools: Tool A scans the infrastructure every 10 minutes and sends alerts immediately after a scan; Tool B uses event-driven triggers to detect changes in real time and sends alerts immediately. Which tool should the team choose to meet the 5-minute alerting requirement?

   • AEither tool, because both can be configured to alert within 5 minutes by adjusting the scan interval.
   • BTool A, because scanning every 10 minutes is sufficient and simpler to maintain.
   • CNeither tool, because continuous monitoring cannot guarantee 5-minute alerting.
   • DTool B, because event-driven detection can alert within seconds of a change, well under the 5-minute requirement.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is a common integration point for defensive automation?

   • AHuman resource management systems
   • BAccounting software
   • CSecurity information and event management (SIEM) systems
   • DCustomer relationship management (CRM) software
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security operations team wants to implement defensive automation to handle repetitive tasks such as log analysis and alert triage. The team has a mix of on-premises and cloud-based security tools. They want to ensure that the automation can work across both environments without requiring separate workflows. Which approach is most appropriate?

   • AUse a scripting language to write custom scripts for each tool.
   • BMigrate all security tools to the cloud to simplify automation.
   • CCreate separate workflows for on-premises and cloud tools to avoid integration issues.
   • DUse a SOAR platform that has connectors to both on-premises and cloud tools, and design a single workflow that uses environment-specific actions.
   Reveal Solution Discussion Select an answer first