Security Automation Fundamentals GASAE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team has a playbook that automatically quarantines a compromised host, but the playbook requires a human to manually check a threat-intel feed and then manually trigger the quarantine. The team wants to reduce the manual steps while keeping human oversight for the final quarantine action. Which approach best meets this requirement?

   • AAutomate the threat-intel check and the quarantine, but log all actions for later review by the security manager.
   • BKeep the manual threat-intel check but automate only the quarantine command so the analyst still does the research.
   • CUse orchestration to automatically pull the threat-intel feed and present a recommendation, but require an analyst to approve the quarantine action.
   • DReplace the entire playbook with a fully automated script that runs on a schedule and quarantines any host matching the threat-intel feed.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security operations center uses a SOAR platform. They have a playbook that automatically enriches an alert with threat intelligence, checks if the affected asset is in a critical business unit, and then sends a notification to the on-call analyst. The analyst then manually logs into the firewall and blocks the malicious IP. Which statement best describes this scenario?

   • AThe playbook is an example of automation only, since it uses a SOAR platform to execute a predefined sequence of steps.
   • BThe playbook demonstrates orchestration because it coordinates multiple tools and processes, but the manual firewall block is a gap in automation.
   • CThe playbook is a pure orchestration example because it only coordinates existing tools and does not automate any individual task.
   • DThe playbook is a pure automation example because it runs without human intervention from start to finish.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a typical use case for security automation?

   • AAutomatically enriching alerts with threat intelligence and creating incident tickets
   • BAutomatically shutting down the entire network upon any detected anomaly
   • CAutomatically rewriting firewall rules to block all traffic from unknown IP addresses
   • DAutomatically escalating all security alerts to the highest priority
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security engineer is asked to automate a process that involves parsing a complex, unstructured threat report and extracting indicators of compromise (IOCs). The engineer has a limited budget and needs to deliver a solution quickly. What is the most practical approach?

   • AAutomate the process by having the parser extract all text and then use a simple keyword search to find IOCs.
   • BDevelop a custom machine learning model to parse the reports, which will be more accurate in the long run.
   • CAsk the threat intelligence team to manually extract the IOCs and enter them into the system, bypassing automation.
   • DUse a pre-built parser from a SOAR platform that can handle common threat report formats, and manually review any reports it cannot parse.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A small security team manually reviews every alert from their EDR, SIEM, and cloud-native detection tools. The team is overwhelmed by the volume and has started missing critical alerts. They want to reduce alert fatigue without losing visibility into genuine threats. Which approach best aligns with security automation fundamentals?

   • AIncrease the number of security analysts on the team to manually review all alerts, ensuring no alert is ever missed due to volume.
   • BAutomate the immediate containment of every alert that matches a known signature, without any human review, to ensure no genuine threat is missed.
   • CDisable all low-severity alerts in the SIEM so that the team only sees high-severity alerts, reducing the volume they need to review.
   • DAutomate the triage of low-fidelity alerts by enriching them with threat intelligence and suppressing those that meet a defined false-positive pattern, while escalating only high-confidence alerts for human review.
   Reveal Solution Discussion Select an answer first