Defensive Security Automation GASAE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a method for validating defensive automation?

   • ADisabling logging to speed up the automation
   • BRunning the automation in a sandbox environment with simulated threats
   • CReviewing the automation code only once at the end of the year
   • DDeploying the automation directly to production without review
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security team has an automated alerting system that triggers on known malware signatures. The team notices that the system is generating an increasing number of false positives because new benign software uses similar signatures. What should the team do to maintain the effectiveness of the automation?

   • AIncrease the alert threshold to reduce the number of alerts.
   • BUpdate the detection logic to include contextual information such as process parent and file reputation.
   • CKeep the current logic and add a weekly report of false positives.
   • DDisable the automated alerting and rely on manual review.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security team has developed an automated playbook that quarantines a user account when multiple failed login attempts are detected. Before deploying this playbook to production, the team wants to validate that it works correctly and does not lock out legitimate users. Which testing approach is most appropriate?

   • AReview the playbook code manually and assume it is correct.
   • BDeploy the playbook to production and monitor for user complaints.
   • CRun the playbook in a staging environment with simulated login failures and verify that only the intended accounts are quarantined.
   • DRun the playbook against a single production user account that is known to be inactive.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security engineer is designing an automated incident response workflow for a phishing email campaign. The workflow should: (1) extract indicators from the email, (2) block the sender and URLs in the email gateway, (3) notify the affected user, and (4) create a ticket. The engineer wants to ensure the workflow is reliable and does not cause unintended consequences. What is the most important design consideration?

   • ARunning the workflow only during business hours to avoid after-hours issues.
   • BUsing a single large script that performs all steps sequentially.
   • CAdding error handling and rollback steps for each action in the workflow.
   • DMaking the workflow send a notification to all employees about the phishing campaign.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A small security team is overwhelmed by the volume of low-severity alerts and is considering implementing defensive automation. The team wants to reduce the time spent on manual triage while ensuring that critical incidents are still escalated to human analysts. Which automation strategy best achieves this goal?

   • AAutomate the triage of low-severity alerts by enriching them with context and closing them if they are confirmed false positives, while routing high-severity alerts to human analysts.
   • BAutomate the response to all alerts, including high-severity ones, to eliminate the need for human analysts.
   • CAutomate the escalation of all alerts to the on-call analyst without any pre-processing.
   • DUse automation only to collect and store alerts, leaving all analysis and response to humans.
   Reveal Solution Discussion Select an answer first