Defensive Security Automation GASAE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a key benefit of defensive security automation?

   • AIt ensures that no security incidents ever occur
   • BIt enables faster and more consistent response to security incidents
   • CIt eliminates the need for security policies
   • DIt automatically patches all software vulnerabilities without any configuration
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company uses multiple security tools: an EDR, a network intrusion detection system (NIDS), and a vulnerability scanner. The security team wants to automate threat detection by correlating alerts from these tools. They have a SOAR platform. What is the first step to integrate these tools?

   • ADevelop custom parsers for each tool's alert format and normalize them into a common schema.
   • BReplace all tools with a single vendor's suite to ensure compatibility.
   • CManually copy alerts from each tool into a spreadsheet for analysis.
   • DConfigure each tool to send alerts to a shared email inbox.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary function of automated threat detection?

   • ATo continuously monitor systems and identify potential security threats
   • BTo replace the need for security information and event management (SIEM) systems
   • CTo generate reports for management review
   • DTo automatically patch vulnerabilities without human approval
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team has an automated vulnerability remediation system that applies patches to servers. The system uses a risk score to prioritize which servers to patch first. Recently, the team discovered that the risk score is based on the CVSS base score only and does not consider whether the server is internet-facing or contains sensitive data. As a result, an internet-facing server with a moderate CVSS score was patched after an internal server with a high CVSS score, leaving the internet-facing server exposed longer. The team wants to improve the prioritization. Which change is most appropriate?

   • APatch all servers simultaneously to eliminate the need for prioritization.
   • BIgnore the risk score and patch servers in the order they were discovered by the scanner.
   • CUse only the CVSS base score but manually override the order for internet-facing servers.
   • DModify the risk score calculation to include environmental factors such as internet exposure and data sensitivity, and re-run the prioritization.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's automated threat detection system uses a list of malicious IP addresses that is updated daily. Recently, the system has been generating false positives because some IP addresses on the list have been reassigned to legitimate services. The security team wants to reduce false positives while maintaining detection capability. Which action should be taken?

   • AKeep the daily refresh but manually review each alert before it is sent.
   • BShorten the IP address list refresh interval to hourly and add a validation step that checks the current owner of each IP before alerting.
   • CRemove all IP addresses from the list and rely only on behavioral detection.
   • DIncrease the alert threshold so that only repeated matches trigger an alert.
   Reveal Solution Discussion Select an answer first