Security Automation Fundamentals GASAE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team deploys an automated alert-triage system that enriches alerts with threat-intel data and assigns a severity score. The system is fast, but analysts have lost trust in it because it sometimes scores a benign alert as critical, causing unnecessary escalations. The team wants to keep the speed of automation but restore trust. Which approach is the most balanced?

   • ARemove the automation and have analysts manually enrich and score all alerts.
   • BIncrease the number of threat-intel sources used by the automation to improve accuracy.
   • CKeep the automation but ignore the severity scores and have analysts review every alert manually.
   • DAdd a feedback loop where analysts can mark alerts as false positives, and use that feedback to tune the scoring algorithm.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team is manually copying and pasting indicators of compromise (IOCs) from threat intelligence reports into their firewall and EDR tools. This process is slow and sometimes results in typos. What is the primary benefit of automating this process?

   • AIt will reduce the chance of human error and ensure that the IOCs are consistently applied across all tools.
   • BIt will eliminate the need for threat intelligence reports entirely.
   • CIt will make the firewall and EDR tools completely immune to all attacks.
   • DIt will automatically identify new threats that are not in the threat intelligence reports.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst wants to automate the initial triage of alerts from a new EDR tool. The analyst is concerned about the quality of the alerts and wants to avoid automating a process that is not well understood. What is the most appropriate first step?

   • AAutomate the creation of a ticket for every alert and assign it to the most junior analyst.
   • BAutomate the suppression of all alerts that are not marked as 'critical' by the EDR tool.
   • CStart by automating the data enrichment step, such as looking up the reputation of a file hash, and leave the decision-making to the analyst.
   • DAutomate the full triage process, including the decision to escalate or close the alert, to maximize efficiency from the start.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary difference between security automation and security orchestration?

   • AAutomation requires human intervention, while orchestration is fully autonomous
   • BAutomation is a subset of orchestration, but orchestration does not use automation
   • CAutomation focuses on individual tasks, while orchestration coordinates multiple automated tasks across different systems
   • DAutomation is only used for threat detection, while orchestration is used for incident response
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team has a set of automated scripts that each perform a single task, such as pulling logs, checking for indicators, and updating a ticketing system. The team wants to combine these scripts into a single incident-response workflow that can be triggered by a SIEM alert and that includes conditional logic and rollback on failure. What should they build?

   • AA shared database where each script writes its output and the next script reads it.
   • BAn orchestration workflow that defines the sequence, conditions, and error handling for the scripts.
   • CA single large script that calls the other scripts in a fixed order.
   • DA cron job that runs all the scripts at the same time whenever the SIEM alert is generated.
   Reveal Solution Discussion Select an answer first