Security Automation Fundamentals GASAE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a common integration challenge when deploying security automation?

   • AAutomation requires a dedicated physical server for each security tool
   • BAutomation cannot be used with cloud-based security services
   • CAutomation tools are always proprietary and cannot integrate with any other vendor's products
   • DDifferent security tools may have incompatible APIs or data formats, making integration complex
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team has a SOAR platform. They have a playbook that, when a new malware signature is detected, automatically updates the firewall rules, sends a notification to the security team, and opens a ticket in the ticketing system. This playbook is an example of:

   • AA manual process, because it requires a human to initiate the playbook.
   • BA compliance control, because it ensures all security actions are documented.
   • CAutomation, because it performs a single task without human intervention.
   • DOrchestration, because it coordinates multiple automated tasks across different systems.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of security automation in modern security operations?

   • ATo execute predefined security tasks programmatically, reducing manual effort and enabling faster response
   • BTo store security logs and alerts in a centralized database for later analysis
   • CTo replace human security analysts entirely with machine learning models
   • DTo eliminate the need for security policies and compliance frameworks
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team wants to use automation to proactively search for signs of compromise across their environment, rather than waiting for alerts to fire. They have a list of known-bad indicators and a set of queries that can be run against their log platform. Which automation use case best matches this goal?

   • AAutomate the execution of the queries on a schedule and generate a report of any matches.
   • BAutomate the collection of logs from all endpoints into a central repository.
   • CAutomate the response to any alert that fires from the SIEM.
   • DAutomate the creation of compliance reports for auditors.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team has implemented an automated playbook that quarantines a user's device when the EDR tool detects a specific malware strain. The playbook has been running for a month. The team has noticed that the playbook is triggering on a legitimate application that behaves similarly to the malware. This has resulted in several users being unable to work. What is the most appropriate action to address this issue?

   • ADisable the automated playbook and revert to manual quarantine procedures to avoid any further disruption.
   • BModify the EDR tool's detection rules to exclude the legitimate application from all detection.
   • CAdd a validation step to the playbook that checks if the affected device is running the legitimate application before quarantining it.
   • DIncrease the severity threshold for the malware detection so that the playbook only triggers on more severe cases.
   Reveal Solution Discussion Select an answer first