Security Automation Fundamentals GASAE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team automates the containment of a compromised user account by disabling it and forcing a password reset. The automation works well, but the team is concerned that a legitimate user might be locked out if the automation triggers on a false positive. They want to keep the automation but reduce the risk of locking out legitimate users. Which control best addresses this concern?

   • ARequire a second independent signal, such as a separate detection source, before the automation disables the account.
   • BDisable the automation and have analysts manually disable accounts after reviewing each alert.
   • CAdd a delay of 24 hours before the automation disables the account.
   • DAutomate the password reset but not the account disable, so the user can still log in.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which statement best describes how security automation fits into a modern Security Operations Center (SOC)?

   • AIt is a standalone technology that operates independently of other security tools
   • BIt replaces the need for security information and event management (SIEM) systems
   • CIt is primarily used for generating compliance reports and has little impact on incident response
   • DIt is a set of practices and tools that automate repetitive security tasks, improving efficiency and consistency
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A compliance team must generate a monthly report demonstrating that all user access reviews were completed on time. Currently, an analyst manually exports data from the IAM system, cross-references it with the HR system, and creates a spreadsheet. Which automation use case would best address this scenario?

   • AAutomate the creation of new user accounts in the IAM system based on HR records.
   • BAutomate the deletion of user accounts that have not been reviewed in the last 90 days.
   • CAutomate the data collection and report generation process to ensure consistency and reduce manual effort.
   • DAutomate the user access review decisions themselves, allowing the system to approve or deny access without human input.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team automates the response to phishing emails by automatically removing the email from all mailboxes and blocking the sender. The automation works, but occasionally a legitimate email is removed because it was incorrectly classified as phishing. The team wants to keep the automation but reduce the risk of removing legitimate emails. Which control is the most effective?

   • ARequire a minimum number of user reports or a second detection engine before the automation removes an email.
   • BAutomate the removal but do not block the sender, so legitimate senders are not affected.
   • CRemove the automation and have analysts manually review every reported email.
   • DDelay the removal by 24 hours to give users time to notice if the email is legitimate.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is considering automating a task that involves parsing logs from a legacy system. The analyst has determined that the task is performed only once a month and takes about 10 minutes. What is the most appropriate decision regarding automation?

   • AAutomate the task but only if it can be completed in under 5 minutes.
   • BDo not automate the task because the frequency and time saved do not justify the effort of building and maintaining the automation.
   • CAutomate the task immediately to gain experience with the automation platform.
   • DAutomate the task because any automation is better than manual work.
   Reveal Solution Discussion Select an answer first