Security Automation Fundamentals GASAE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team has automated a process that automatically blocks IP addresses that are flagged by their threat intelligence feed. The automation has been running for several weeks. The team has discovered that a legitimate partner's IP address was blocked, causing a disruption to a critical business application. What is the most likely cause of this issue?

   • AThe automation was not running frequently enough to keep up with the threat intelligence feed.
   • BThe automation was configured to block all IP addresses in the threat intelligence feed, including those that were only flagged for informational purposes.
   • CThe automation was not integrated with the firewall correctly, causing it to block the wrong IP address.
   • DThe threat intelligence feed contained a false positive, and the automation did not have a mechanism to verify the accuracy of the indicator before blocking.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security engineer is designing an automated phishing response playbook. The playbook will automatically remove a reported phishing email from all mailboxes and block the sender. Before deploying this playbook, which consideration is most critical to address?

   • AEnsuring the playbook is integrated with the email gateway to automatically quarantine the email.
   • BEnsuring the playbook notifies the security team after the email is removed from all mailboxes.
   • CEnsuring the playbook can distinguish between a true phishing email and a legitimate email that was reported by mistake.
   • DEnsuring the playbook runs as quickly as possible to minimize the time the phishing email remains in user inboxes.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team wants to automate the initial response to a specific type of incident: a user clicking a link in a phishing email. The team wants the automation to disable the user's account and notify the incident response team, but only if the email is confirmed as malicious. Which approach best implements this with appropriate control?

   • AAutomate both the account disable and the notification whenever the email is marked as phishing by any user.
   • BDo not automate anything and have analysts manually handle each phishing click.
   • CAutomate the account disable immediately, and notify the incident response team after the fact.
   • DAutomate the notification to the incident response team, but require a human analyst to confirm the email is malicious before the account is disabled.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team wants to use automation to improve their compliance reporting. They need to provide evidence that security patches are applied to all servers within 30 days of release. What is the most effective way to automate this process?

   • AAutomate the creation of a ticket for every server that has a pending patch, but do not track whether the patch is applied.
   • BAutomate the process of applying patches to all servers immediately after they are released.
   • CAutomate the deletion of servers that are not patched within 30 days to ensure compliance.
   • DAutomate the collection of patch status from the configuration management database and generate a report that highlights any servers not patched within the required timeframe.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How do security automation and orchestration complement each other in a security operations context?

   • AOrchestration coordinates multiple automated tasks to execute a complete incident response process
   • BOrchestration provides the individual automated steps, while automation defines the overall workflow
   • CAutomation and orchestration are interchangeable terms that describe the same process
   • DAutomation is used only for simple tasks, while orchestration is used only for complex tasks
   Reveal Solution Discussion Select an answer first