Defensive Security Automation GASAE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Why is it necessary to maintain and update defensive automation?

   • ATo reduce the need for security monitoring
   • BTo ensure the automation runs faster
   • CTo comply with software licensing agreements
   • DTo adapt to evolving threats and changes in the environment
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company has an automated incident response playbook that isolates a compromised host by applying a network access control list (ACL) via the firewall API. During a recent ransomware simulation, the playbook successfully isolated the host, but the security team was not notified until 20 minutes later because the notification step ran after the isolation step and the notification service was temporarily unavailable. The team wants to ensure that notifications are sent reliably and promptly. Which improvement should be made to the playbook?

   • AAdd a retry loop with exponential backoff for the notification step and move it to the beginning of the playbook before isolation.
   • BRemove the notification step from the playbook and rely on the firewall's built-in alerting to notify the team.
   • CKeep the notification step after isolation but change it to send an email instead of using the notification service.
   • DAdd a manual approval step before the notification step to ensure the team is aware before any action is taken.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company uses a SOAR platform to automate incident response. The SOAR platform integrates with the ticketing system, the SIEM, and the firewall. The team wants to create a playbook that, when a SIEM alert is received, creates a ticket, enriches the alert with threat intelligence, and if the alert is confirmed, blocks the source IP on the firewall. The team is concerned about the reliability of the integration with the threat intelligence service, which occasionally times out. Which design should be used to ensure the playbook completes even if the threat intelligence service is unavailable?

   • ABlock the IP immediately upon alert receipt, without waiting for enrichment.
   • BSkip the ticket creation and only block the IP if enrichment succeeds.
   • CUse a timeout and fallback mechanism: if threat intelligence enrichment times out, proceed with the alert as unconfirmed and still create the ticket, but do not block the IP automatically.
   • DMake the threat intelligence enrichment a mandatory step and fail the playbook if it times out.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which of the following is a best practice for designing defensive automation workflows?

   • AHardcoding all parameters to avoid configuration changes
   • BUsing a single large script for all automation tasks
   • CBreaking the workflow into small, modular steps
   • DRunning the workflow without logging to reduce overhead
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security team is setting up continuous monitoring for a new application. The monitoring system must detect anomalies in user behavior, such as unusual login times or excessive data downloads. The team has historical data from the application's first month of operation, but the application is new and user behavior is expected to evolve. The team wants to minimize false positives while still detecting genuine anomalies. Which approach is most appropriate?

   • ASet very high thresholds for alerts to avoid false positives.
   • BUse a baseline model trained on the first month of data and update the baseline periodically as new data is collected.
   • CUse a static baseline from the first month and never change it.
   • DAlert on every deviation from the baseline, no matter how small.
   Reveal Solution Discussion Select an answer first