Defensive Security Automation GASAE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a typical automated incident response action?

   • AWriting a post-incident report manually
   • BIsolating an infected host from the network
   • CConducting a forensic analysis of the incident
   • DNotifying law enforcement agencies
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team has an automated threat detection system that uses a machine learning model to identify anomalies in network traffic. The model was trained on data from the past year. The team notices that the model's false positive rate has increased significantly after a major network infrastructure change. What is the best course of action?

   • ADisable the model and revert to signature-based detection.
   • BRetrain the model with recent network traffic data that reflects the new infrastructure.
   • CKeep the model and manually review all alerts.
   • DIncrease the anomaly detection threshold to reduce false positives.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A vulnerability scanner reports a critical SQL injection flaw in a web application. The security team wants to automate remediation. The application is deployed using infrastructure as code (IaC). What is the best automated remediation approach?

   • AManually edit the code on the production server.
   • BDisable the vulnerable endpoint until a manual fix is developed.
   • CAdd a web application firewall (WAF) rule to block SQL injection attempts.
   • DPatch the code in the IaC templates and automatically redeploy the application.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations team uses a SOAR platform with a playbook that automatically quarantines a user's device when the EDR sends a high-severity alert. During a test, the team discovers that a false positive triggered the playbook and quarantined a critical server, causing an outage. The team wants to reduce the risk of similar incidents without significantly increasing response time. What should they do?

   • ARequire the alert to be confirmed by a second independent detection source before quarantine.
   • BChange the playbook to only quarantine endpoints in the 'Workstations' asset group.
   • CIncrease the EDR alert severity threshold so fewer alerts trigger the playbook.
   • DAdd a human approval step for all high-severity alerts before quarantine.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the purpose of an automated incident response playbook?

   • ATo document the company's security policies for employees
   • BTo automatically patch all vulnerabilities in the environment
   • CTo provide a predefined set of steps to contain and mitigate a security incident
   • DTo replace the need for incident response training
   Reveal Solution Discussion Select an answer first