Defensive Security Automation GASAE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security team wants to set up automated monitoring for unusual outbound network traffic from their data center. They have a network flow log source and a SIEM. The team wants to detect potential data exfiltration. What is the most effective monitoring configuration?

   • AA rule that alerts on any outbound connection to a new external IP.
   • BA dashboard showing top talkers by volume, updated hourly.
   • CA SIEM rule that triggers when a single host sends more than a threshold of data to an external IP in a short time window.
   • DA rule that alerts when total outbound traffic exceeds the monthly average.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company's incident response playbook automatically contains a compromised host by isolating it from the network. The playbook also runs a script to collect forensic evidence before isolation. The team wants to ensure the evidence collection is not disrupted by the isolation. What should the playbook do?

   • ACollect evidence and isolate the host simultaneously.
   • BSkip evidence collection to speed up containment.
   • CCollect evidence first, then isolate the host.
   • DIsolate the host first, then collect evidence.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Why is it important to test defensive automation before deployment?

   • ATo increase the complexity of the automation
   • BTo ensure the automation works as intended and does not cause unintended consequences
   • CTo comply with licensing requirements
   • DTo reduce the need for security monitoring
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary purpose of defensive security automation?

   • ATo automate the exploitation of vulnerabilities in a controlled environment
   • BTo replace human security analysts entirely in all security operations
   • CTo automate the identification, analysis, and mitigation of security threats with minimal human intervention
   • DTo generate compliance reports for regulatory audits
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security team wants to implement continuous monitoring for suspicious login activity across their cloud environment. They have a SIEM that ingests logs from multiple sources. The team needs to be alerted in near real-time when a user logs in from a new geographic location and then performs a privileged action within 10 minutes. What should they configure?

   • AAn alert that triggers when any user logs in from a new location.
   • BA dashboard that displays all login and privileged action events for manual review.
   • CA SIEM correlation rule that triggers an alert when a login event and a privileged action event occur from the same user within a 10-minute window.
   • DA separate alert for every login from a new location and another for every privileged action.
   Reveal Solution Discussion Select an answer first