Defensive Security Automation GASAE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is an example of an automated threat detection mechanism?

   • AA policy that requires employees to change passwords every 90 days
   • BA manual review of firewall rules by a security analyst
   • CA script that analyzes system logs for known indicators of compromise
   • DA scheduled backup of critical databases
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security engineer is designing an automated threat detection workflow for a fleet of Windows servers. The workflow must collect security event logs every 5 minutes, correlate them with known indicators of compromise (IOCs), and trigger an incident ticket only when a correlation confidence score exceeds 0.8. The engineer wants to avoid alert fatigue while ensuring that a newly discovered IOC is applied within 15 minutes of publication. Which approach best meets these requirements?

   • AUse a continuous log streaming agent that pushes events in real time, correlate against a static IOC list updated manually once a day, and alert on any match regardless of confidence.
   • BUse a scheduled task that runs every 15 minutes to collect all logs, correlate with the latest IOC feed, and generate a ticket for every event that matches at least one IOC.
   • CUse a log collection tool that pulls logs every 5 minutes, correlates with an IOC feed updated every hour, and suppresses alerts for low-confidence matches without creating tickets.
   • DUse a log ingestion pipeline that queries the servers every 5 minutes, runs correlation against a locally cached IOC feed that is refreshed every 15 minutes, and creates a ticket only when the confidence threshold is met.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company's automated threat detection system uses a machine learning model to identify phishing emails. The model was trained on email data from the past year. Recently, the company has seen an increase in phishing emails that use new techniques, and the model's detection rate has dropped. The security team wants to improve the model's performance. Which action is most appropriate?

   • ARetrain the model periodically with new phishing samples and validate its performance on a held-out test set.
   • BIncrease the model's alert threshold to reduce false positives.
   • CReplace the machine learning model with a rule-based system that uses known phishing indicators.
   • DKeep the model unchanged and manually review all emails that the model flags.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security team is building an automated incident response playbook for a malware infection. The playbook should: (1) quarantine the infected host, (2) kill the malicious process, (3) collect a memory dump, and (4) notify the incident response team. The team is concerned about the order of actions because killing the process may prevent memory dump collection. What is the best order?

   • AQuarantine the host, kill the process, then collect the memory dump.
   • BKill the malicious process, then collect the memory dump, then quarantine the host.
   • CQuarantine the host, collect the memory dump, then kill the malicious process.
   • DCollect the memory dump, kill the process, then quarantine the host.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A SOAR playbook automatically blocks an IP address in the firewall when a threat intelligence feed reports it as malicious. The team is concerned about blocking a legitimate IP due to a false positive. What is the best way to test the playbook before production?

   • AReview the playbook code and manually verify the API calls.
   • BUse a test firewall and a simulated threat intelligence feed with known benign IPs to verify the playbook does not block them.
   • CBlock a known benign IP in production and then unblock it after a few minutes.
   • DRun the playbook in production with a low-severity feed to see what happens.
   Reveal Solution Discussion Select an answer first