Security Automation Fundamentals GASAE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team is building a SOAR playbook to respond to a specific type of alert. The playbook needs to enrich the alert with threat intelligence, check if the affected asset is a domain controller, and then either block the IP or notify the team. The team is debating whether to automate the IP blocking or to require manual approval. Which factor is most important in this decision?

   • AThe potential impact of a false positive blocking a legitimate IP address.
   • BThe skill level of the security analysts who will be reviewing the alerts.
   • CThe number of alerts the team receives on a daily basis.
   • DThe time it takes for the playbook to enrich the alert with threat intelligence.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security operations team is evaluating a SOAR platform to automate their incident response. They have a mature incident response process that is well-documented but relies on several legacy tools that do not have native integrations with the SOAR platform. What is the most important factor to consider when implementing the SOAR platform?

   • AThe user interface of the SOAR platform and how easy it is for analysts to use.
   • BThe ability to integrate the legacy tools with the SOAR platform, even if it requires custom scripting or APIs.
   • CThe speed at which the SOAR platform can execute the automated playbooks.
   • DThe cost of the SOAR platform compared to the cost of hiring additional analysts.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security team has a fully automated incident-response workflow that contains a compromised host and notifies the IR team. The workflow is fast, but the IR team is concerned that the automation sometimes contains hosts that are not actually compromised, causing business disruption. They want to keep the speed of automated containment but add a human decision point without slowing down the initial response. Which design best achieves this?

   • ARemove the automated containment and have analysts manually contain hosts after reviewing each alert.
   • BAutomate the containment but only for hosts that have been flagged by two independent detection sources.
   • CAutomate the containment immediately, but require the IR team to approve the release of the host after investigation.
   • DAutomate the initial enrichment and notification, but require a human analyst to approve the containment action.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a key benefit of security automation?

   • AIt eliminates the need for security monitoring tools
   • BIt increases the consistency of security processes by following predefined steps
   • CIt automatically patches all vulnerabilities without any risk of system downtime
   • DIt guarantees that all security incidents are completely resolved without human intervention
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team wants to automate the process of checking for misconfigurations in their cloud environment. They have a set of compliance rules that need to be checked against their cloud resources. What is the most appropriate way to implement this?

   • AAutomate the process of applying fixes to any misconfiguration that is found.
   • BAutomate the process of creating a ticket for every resource that is not compliant.
   • CAutomate the process of disabling any resource that is not compliant.
   • DUse a cloud security posture management (CSPM) tool that can continuously scan the environment and automatically alert on misconfigurations.
   Reveal Solution Discussion Select an answer first