How can security automation support compliance efforts?

By eliminating the need for regular security audits

By automatically changing security policies to meet the latest regulatory requirements without human review

By automatically generating and collecting evidence of security controls for audits

By automatically deleting all logs that are not required for compliance

A security team is planning to automate a threat hunting process that involves querying multiple data sources. The team is concerned about the complexity of integrating different APIs and data formats. What is the most effective way to address this challenge?

Use a SOAR platform that provides pre-built integrations and a common data model for the different data sources.

Limit the automation to only one data source to avoid the complexity of integration.

Write custom scripts for each data source and manually combine the results in a central spreadsheet.

Automate the process using a simple scripting language that can only handle one data format at a time.

A security analyst is asked to automate the process of checking for new user accounts created in the last 24 hours and verifying they have completed the mandatory security training. What is the most appropriate way to implement this?

Create a script that queries the IAM system for new accounts and cross-references them with the training database, then generates a report of any accounts that have not completed training.

Automate the process of sending a reminder email to new users who have not completed training.

Automate the process of disabling any new account that has not completed training within 24 hours.

Automate the process of creating a ticket for every new user account, regardless of training status.

A small security team manually reviews every alert from their SIEM, which generates about 200 alerts per day. They want to reduce the time analysts spend on repetitive triage without losing visibility into high-severity incidents. Which automation use case best fits this need?

Automatically close all low-severity alerts without any analyst review.

Use automation to generate a daily report of all alerts but continue manual review of every alert.

Automate the initial enrichment and correlation of alerts, then route only high-severity alerts to analysts for review.

Automate the response to all alerts by running a generic containment script.

A security team has automated a threat hunting process that queries the SIEM for suspicious logins. The automation runs every hour and generates a list of potentially compromised accounts. The team has found that the list is too long and contains many false positives, making it difficult to focus on real threats. What is the most effective way to improve the automation?

Add a risk-scoring step to the automation that prioritizes accounts based on the sensitivity of the data they can access and the number of failed logins.

Increase the frequency of the automation to run every 15 minutes so that the team has more data to work with.

Disable the automation and have the team manually review all login logs at the end of each day.

Modify the automation to only report on accounts with more than 10 failed logins in an hour.

GIAC AI Security Automation Engineer

Domain 1Objective 1

Security Automation Fundamentals GASAE Practice Questions (Page 7)

Part of the Security Automation Foundations domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 31–35

31foundation · easy
How can security automation support compliance efforts?
Select an answer first
32application · medium
A security team is planning to automate a threat hunting process that involves querying multiple data sources. The team is concerned about the complexity of integrating different APIs and data formats. What is the most effective way to address this challenge?
Select an answer first
33application · medium
A security analyst is asked to automate the process of checking for new user accounts created in the last 24 hours and verifying they have completed the mandatory security training. What is the most appropriate way to implement this?
Select an answer first
34application · medium
A small security team manually reviews every alert from their SIEM, which generates about 200 alerts per day. They want to reduce the time analysts spend on repetitive triage without losing visibility into high-severity incidents. Which automation use case best fits this need?
Select an answer first
35expert · hard
A security team has automated a threat hunting process that queries the SIEM for suspicious logins. The automation runs every hour and generates a list of potentially compromised accounts. The team has found that the list is too long and contains many false positives, making it difficult to focus on real threats. What is the most effective way to improve the automation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASAE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASAE” is a trademark of its owner, used for identification only.